Malicious PDF — malware analysis report

Static analysis result for SHA-256 625faef533d795b3…

MALICIOUS

PDF

47.2 KB Authoring application: OpenOffice Draw
MD5: 28643fb0f80f1213dc3468214d06c0ca SHA-1: c53df12d6b1b2468e2e250c3123f69def2aaccec SHA-256: 625faef533d795b3f34ead601642fbe1d49ea3e8340347afc1e7fd425206687a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and a high-confidence ML classifier, indicating malicious intent. The embedded URLs, such as http://compoundskin.com/uploads/1/3/0/6/130604010/7382082e.pdf, suggest a link farm designed to redirect users to potentially harmful content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports the phishing and traffic redirection nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://compoundskin.com/uploads/1/3/0/6/130604010/7382082e.pdf
    • http://morganlwebster.com/uploads/1/3/0/5/130588999/6770359.pdf
    • http://minimatisse.shop/uploads/1/3/0/2/130287424/6974893.pdf
    • http://yctl.org/uploads/1/3/0/7/130739579/zoketepol-fububoresufut-bonufimimejil-nalaxabo.pdf
    • http://perfectcentral.net/uploads/1/3/0/3/130379219/vixebuzizefe.pdf
    • http://chitowngala.com/uploads/1/3/0/6/130620698/8031218.pdf
    • http://thepioneercrafthouse.org/uploads/1/3/0/5/130590339/tebimakipava.pdf
    • http://1m3dp.com/uploads/1/3/0/6/130620441/tokadapazam.pdf
    • http://zambiasafarihunting.com/uploads/1/3/0/2/130272347/130272347.html#audi+a3+sportback+2019+manual
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011e4.bin
dae0213650d03df7e82fdce0f8706f98df93448ca57c64a270bbe6d437626a5f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E4 9948 bytes
font_01_sfnt_off00007254.bin
4b9d5ed4380496a01ba159619359c68b929b4365047eb67ca52b427bb012304a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7254 16132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.