Malicious PDF — malware analysis report

Static analysis result for SHA-256 62ee465703b1fd17…

MALICIOUS

PDF

43.1 KB Authoring application: Soda PDF
MD5: ba5c3ad13cbeca0d36400cced0821575 SHA-1: cfa5f02d6391d274c83d78258b3e414af42bb825 SHA-256: 62ee465703b1fd17ab814c5208535548f32eb1b71ebc7645d291678e0994d78e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, a technique often used for SEO spam or to redirect users to malicious sites. ClamAV detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', and an ML classifier also flagged it as malicious. The document body, though heavily obfuscated, contains URLs that are consistent with this behavior.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://deadlygraphix.com/uploads/1/3/0/5/130590163/finav_begerubisudemo_lubitezekem.pdf
    • http://sjb-productions.com/uploads/1/3/0/5/130590105/wilezogolufo-bizijemodapi-kubobaduzas-gumiliweteda.pdf
    • http://msandtherapist.com/uploads/1/3/0/5/130550835/jarunik-narovirikobitiv-japerupoxisale-tadukej.pdf
    • http://afaparents.org/uploads/1/3/0/5/130539046/130539046.html#balkenm%C3%A4her+reform+hobby+55

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010c9.bin
5489040c7406466dc14af14fec08502cd5e1a2d65ff13c315d5f595406f50be6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10C9 9716 bytes
font_01_sfnt_off00006f04.bin
b35500d9fcbb6c09d8ada108e09b3729dcb9bfd586a05bf0b2955f28f0c3a593		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6F04 1612 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.