Malicious PDF — malware analysis report

Static analysis result for SHA-256 62049c96f5381396…

MALICIOUS

PDF

46.1 KB Authoring application: PDFedit
MD5: 46262a55cec4a5dc7f3af356fa9e4c98 SHA-1: c5f28a44a720b2620f2ac29eb0844c6783cea356 SHA-256: 62049c96f53813967d36cc5413e85b4b7395b46da332fac77983dde7961bcf8b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. ClamAV detected this file as Pdf.Phishing.TtraffRobotInstall, indicating a phishing or traffic redirection intent. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nordbygdahandball.no/uploads/1/3/0/7/130739286/lalavoxezekaje.pdf
    • http://southernspurr.com/uploads/1/3/0/6/130639157/vinaf.pdf
    • http://myteamtriumph-ga.org/uploads/1/3/0/5/130545333/8794634.pdf
    • http://howtoinstallsiding.net/uploads/1/3/0/5/130544072/e823e664.pdf
    • http://smartmobilityinc.com/uploads/1/3/0/5/130588575/lagerotox-zorenedud.pdf
    • http://dwoslab.com/uploads/1/3/0/5/130589308/636d9f1c95.pdf
    • http://bexbot.com/uploads/1/3/0/4/130435650/1df50079b71c.pdf
    • http://my-mediamatters.tech/uploads/1/3/0/2/130272369/4755506.pdf
    • http://5pointauto.com/uploads/1/3/0/6/130639488/f0ccd6d0.pdf
    • http://parisglam.com/uploads/1/3/0/5/130589237/fee9e7562.pdf
    • http://metricdesignstudionyc.com/uploads/1/3/0/7/130775822/tileduwuke_toraw.pdf
    • http://oreade.ch/uploads/1/3/0/3/130323281/pexugumoroxo.pdf
    • http://poppyandrose.co.uk/uploads/1/3/0/2/130270989/130270989.html#iso+27001+external+audit+report

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012d9.bin
4b88afe30646036db260cdb7cc18723f5751a05677022d8632fc240243a83b1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12D9 8080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.