Malicious PDF — malware analysis report

Static analysis result for SHA-256 65efe7f3bc6bd34a…

MALICIOUS

PDF

38.5 KB Authoring application: pdf-parser
MD5: 1d8f0530b06815b2f8938c2e5ffe33f3 SHA-1: 1dde8e95bc5fbc71609a8c800252ee6841b9bf31 SHA-256: 65efe7f3bc6bd34a1b8415ca84cc21d69c4bac697e0e96e7f9e145883431bf89
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, a common technique for SEO spam or redirecting users to malicious sites. ClamAV detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection purpose. While no scripts were explicitly extracted, the nature of the embedded links suggests a potential for further malicious activity, possibly involving JavaScript execution if the PDF were opened in a vulnerable viewer.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://forowuvisavox.weebly.com/uploads/1/3/0/2/130270777/vapazox.pdf
    • http://cityglush30.icu/uploads/2020/01/27/najikalurabiwideda.pdf
    • http://acdavisbass.com/uploads/1/3/0/4/130489082/fitulax_xiwobimadizo_lutujogosoxinej.pdf
    • http://writingbydesignpr.com/uploads/1/3/0/5/130543418/af7c6.pdf
    • https://vupusowifi.weebly.com/uploads/1/3/0/5/130590588/kupokazimegez_divitisapewege.pdf
    • http://towe.ekstra123.ru/uploads/2020/01/27/9506109.pdf
    • http://pexezi.promyvkapto.ru/uploads/2020/01/29/2459458.pdf
    • http://paluvanuf.gadsyrai.tech/uploads/2020/01/28/sabazezi.pdf
    • http://befu.aidakit.com/uploads/2020/01/27/vunifuwexerawoz.pdf
    • http://nevumuv.marcexpert.ru/uploads/2020/01/28/magifazawagu.pdf
    • http://sosafazir.mozgach.ru/uploads/2020/01/28/3729867.pdf
    • https://nalizoxuvot.weebly.com/uploads/1/3/0/4/130489228/4389066.pdf
    • http://cyclebavaria.com/uploads/1/3/0/3/130313192/130313192.html#electrolux+precision+vacuum+manual

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012fc.bin
904e6458c57923e29542b2b7a5dd99f9c679d8a77fa71d4aabc89ab7a6d35507		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12FC 8180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.