Malicious PDF — malware analysis report

Static analysis result for SHA-256 5bd90c8aadc7fd24…

MALICIOUS

PDF

46.5 KB Authoring application: PDFBox
MD5: 9d1478d2bb1fbaa0eb9f392b2fa5b95a SHA-1: 858f729df7aebfbd9172f2d6e7276e2f387722d1 SHA-256: 5bd90c8aadc7fd24d9e8e0f811abc6a0418f64b7a4821d1d39fdb98554d04129
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. While no scripts were explicitly extracted, the structure suggests a phishing or content distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theaustinproject.org/uploads/1/3/0/5/130542775/lizunumes.pdf
    • http://rapugawedo.mimosaweb.com/uploads/2020/01/28/basemazaf_xowusuxopazoku.pdf
    • http://amorcocoa.com/uploads/1/3/0/6/130604024/367a15b7.pdf
    • http://vap.fuse0000.online/uploads/2020/01/28/jowibir-vazepime-lawetu-gevakokigam.pdf
    • http://derekfordportfolioshsu.com/uploads/1/3/0/2/130289319/pozenati-zilesafir-zutota.pdf
    • http://nivafoundation.com/uploads/1/3/0/6/130621384/1346753.pdf
    • http://cfdaccounting.net/uploads/1/3/0/6/130640146/48a2f1512b62ab.pdf
    • http://chrisbrooksarchitecture.com/uploads/1/3/0/2/130271038/wazetorode-tofugavi.pdf
    • http://nigelcrossan.com/uploads/1/3/0/3/130313624/jotefopepexidusa.pdf
    • http://athleticsnorth.net/uploads/1/3/0/4/130488503/kupuwawoxibepedefu.pdf
    • http://nupelicanparty.org/uploads/1/3/0/5/130551417/130551417.html#rapid+psp+emulator+games
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001343.bin
67a6425957889c61e0d1de1b90e0cdd1ed4ee444ff692ace0e24a49f0cab6e52		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1343 9272 bytes
font_01_sfnt_off00006cda.bin
55c7abf7ae0aba6c49693877a97b91f57c2a59d8dea67445a51e0bfe4f0fb955		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6CDA 16840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.