Malicious PDF — malware analysis report

Static analysis result for SHA-256 6353154a95dd2250…

MALICIOUS

PDF

47.3 KB Authoring application: PDFedit
MD5: abf62010cc2a5fdb61ab9054f138fb05 SHA-1: b6d27674bc5d6a6c149ad0c7bef8a50768fa5843 SHA-256: 6353154a95dd2250bab888c7df87ca26baf39fe052820cb43cc432db6b279b0d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, detected as a PDF_SEO_LINK_FARM. ClamAV identified the file as Pdf.Phishing.TtraffRobotInstall, indicating a phishing or traffic-generating intent. While no scripts were explicitly extracted, the nature of the links suggests a potential for redirecting users to malicious sites or for SEO manipulation, possibly involving JavaScript execution within the PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chapadaveadeirosturismo.com/uploads/1/3/0/6/130603928/gasimepex.pdf
    • http://papitokids.store/uploads/1/3/0/7/130775440/7517104.pdf
    • http://www.jjsdeepcreektubes.com/uploads/1/3/0/9/130969415/e500a91831b.pdf
    • http://thelanaiclub.com/uploads/1/3/0/5/130589320/427248.pdf
    • http://penguinjournal.online/uploads/1/3/0/5/130551720/1a73aa34397e84.pdf
    • http://fakation.com/uploads/1/3/0/2/130273582/sitofesezuliwano.pdf
    • http://firstmam.com/uploads/1/3/0/2/130288762/pivevupimojimudanila.pdf
    • http://stephenrosinski.com/uploads/1/3/0/8/130873944/jofoniga-wumororatesogu.pdf
    • http://rbarlawrence.com/uploads/1/3/0/6/130639895/5549419.pdf
    • http://www.gfkbuilding.org/uploads/1/3/0/6/130604527/5308932.pdf
    • http://buycialis.com/uploads/1/3/0/4/130476525/jofikogorag.pdf
    • http://redcarpetfestival.live/uploads/1/3/0/8/130813399/kagamatotazuvin_pekimumovefa_jalojapegato_vadivab.pdf
    • http://elcomairbrasil2018.com/uploads/1/3/0/4/130479008/nupex.pdf
    • http://playpass.net/uploads/1/3/0/6/130621947/b17e8.pdf
    • http://candlelight-rsk.com/uploads/1/3/0/3/130313378/e9e030.pdf
    • http://onlineventures101.com/uploads/1/3/0/4/130436173/c597ac0.pdf
    • http://projectindigo.co/uploads/1/3/0/4/130478520/sinajinebir_nadus_jojosu_piguruvatogaw.pdf
    • http://cattywhompus.net/uploads/1/3/0/5/130588875/tofifikedekego_kudegevu.pdf
    • http://ahcweb1.docalton.com/uploads/1/3/0/5/130589275/wiwur_pevowapitebu_rifaboti.pdf
    • http://serafinaappel.com/uploads/1/3/0/2/130287266/130287266.html#rubbing+alcohol+ingestion+emedicine

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000059c7.bin
a008ea99701b40bfaf57544efb15c3697d56b57cf70c4ab41951190973d100c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x59C7 8628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.