Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ca27c5d0ef4d233…

MALICIOUS

PDF

33.0 KB Authoring application: Adobe PDF Library 9.0
MD5: 5b8d7264bccf69768e11f15c3e94b14d SHA-1: 389f143f485d9956b05b377c393a781e2014871f SHA-256: 5ca27c5d0ef4d2336cd4800688b195c2a0eb4e8a9eea85a9438c0c5e8644c089
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including a critical finding for a link farm containing numerous external PDF links, and a ClamAV detection for 'Pdf.Phishing.TtraffRobotInstall'. The embedded URLs suggest a phishing or malware distribution scheme, likely aiming to redirect users to malicious content hosted on external sites. No scripts were extracted, but the overall structure and heuristic firings strongly indicate a malicious intent to exploit users through deceptive links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.graceandgratitudemarket.com/uploads/1/3/0/6/130640039/5042559.pdf
    • http://memphiscounsel.net/uploads/1/3/0/7/130775422/2484812.pdf
    • http://keithnylund.com/uploads/1/3/0/6/130604430/rotujolotono.pdf
    • http://artfelt.shop/uploads/1/3/0/6/130639114/disanajud.pdf
    • http://top20wordpress.com/uploads/1/3/0/4/130477170/zutumapijiwelov-komizobota-nenel-jazigisusuwekak.pdf
    • http://daytonconcretecontractors.com/uploads/1/3/0/6/130604180/4328696.pdf
    • http://biotechoutsourcing.org/uploads/1/3/0/6/130639803/55b0f78.pdf
    • http://cfautobroker.com/uploads/1/3/0/6/130603776/39e2f.pdf
    • http://nettletonband.com/uploads/1/3/0/6/130604209/2954846.pdf
    • http://talinaperkins.com/uploads/1/3/0/7/130739419/5b0193c5.pdf
    • http://x0643993xstreamtravel.xsideas.com/uploads/1/3/0/8/130874308/130874308.html#icd+10+code+for+dysfunctional+uterine+bleeding

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c63.bin
59a7cd3eb53588d367d14f968b4f769cfcc231fbda6a13441f51d7a7d04c6172		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C63 7344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.