Malicious PDF — malware analysis report

Static analysis result for SHA-256 633a661348cf54b6…

MALICIOUS

PDF

42.3 KB Authoring application: SWFTools
MD5: 212966985ea3291f990cce243954714a SHA-1: d3c24bfecdaba19e70526e503ed703d90e0ebdef SHA-256: 633a661348cf54b679c21e103804d82898a994e4d4c037cb92bcdea90cf03683
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malicious content. ClamAV detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', suggesting a phishing or malicious distribution intent. No scripts were extracted, but the sheer volume of external links indicates a coordinated effort to direct users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://readingforliberation.com/uploads/1/3/0/4/130435748/gebugopukit_sopogoruzaf_tiluverenedu_xobexan.pdf
    • http://tommyberry.com/uploads/1/3/0/7/130738644/gaputebebabuninip.pdf
    • http://square6.org/uploads/1/3/0/8/130874084/7405795.pdf
    • http://medinalawgroup.org/uploads/1/3/0/4/130476006/6774460.pdf
    • http://michaelrekas.com/uploads/1/3/0/5/130550885/bipewope-bakep.pdf
    • http://amandaporterfield.com/uploads/1/3/0/2/130291640/b1a0b62bee.pdf
    • http://moderndaymira.com/uploads/1/3/0/6/130620604/wuvegan.pdf
    • http://torchlinksoftware.com/uploads/1/3/0/5/130540937/2dd3b51db59559e.pdf
    • http://biblebasedleader.com/uploads/1/3/0/4/130475994/resed-sowogeparit-gariposedo-gejobadodava.pdf
    • http://acutabove.us/uploads/1/3/0/4/130476205/jafowuvazegugudomop.pdf
    • http://mjstead.com/uploads/1/3/0/5/130540193/8864906.pdf
    • http://datattorney.com/uploads/1/3/0/5/130588816/766b1c977c037e.pdf
    • http://elephantesports.com/uploads/1/3/0/5/130546885/jakuximasejofitepape.pdf
    • http://newspingear.net/uploads/1/3/0/4/130483320/4109223.pdf
    • http://sagensparrow.com/uploads/1/3/0/3/130379292/7037848.pdf
    • http://cancerresearchsimplified.org/uploads/1/3/0/2/130288378/pavowupiri.pdf
    • http://snmfineart.com/uploads/1/3/0/5/130589213/0d06869.pdf
    • http://bigtopplayland.com/uploads/1/3/0/4/130475996/4718535.pdf
    • http://nupelicanparty.org/uploads/1/3/0/2/130272932/130272932.html#como+unir+varios+pdfs+en+uno
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e7c.bin
ff27d99f049fa5ec83b4c3710afe1f9aee00eb20942a9349d435d4ca5ad10f97		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E7C 16388 bytes
font_01_sfnt_off000046db.bin
53da9400f15eb92eddf037797f764af735b34c36f8aa0e5f69eec1ca2c9cbefe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x46DB 8664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.