Malicious PDF — malware analysis report

Static analysis result for SHA-256 6646e8279221dfc1…

MALICIOUS

PDF

38.5 KB Authoring application: QPDF
MD5: 5b7d7211352582b440954b38f6d0b2f9 SHA-1: ffe668acffc9c3b64a00bb817a5d9044a2ed17e7 SHA-256: 6646e8279221dfc17646f0ad0e0c3cf85c5aa727fdab5090fa3cea78beea0953
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute malware. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution. No scripts were extracted, but the sheer volume of outbound links suggests a campaign to drive traffic or deliver payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://retrovideogamez.com/uploads/1/3/0/6/130603927/xebasolukotaje.pdf
    • http://northwestuu.com/uploads/1/3/0/7/130739930/pedataxaxib.pdf
    • http://refugefriendsinc.org/uploads/1/3/0/5/130589124/5573175.pdf
    • http://sdhockey.ca/uploads/1/3/0/2/130273842/xufaperidefapo.pdf
    • http://monksrisboroughprimary.com/uploads/1/3/0/7/130739607/zapopaw.pdf
    • http://cerebromatics.com/uploads/1/3/0/5/130588651/3550993.pdf
    • http://myprizeonline.com/uploads/1/3/0/4/130476492/situborazepaxej.pdf
    • http://puppyuprising.com/uploads/1/3/0/2/130291646/9478394.pdf
    • http://solidinvestmentgroupbvba.com/uploads/1/3/0/4/130490977/mifurifak.pdf
    • http://rant-therapy.com/uploads/1/3/0/4/130436181/xinevukew_puzodavetemux_xipemivinipe.pdf
    • http://pinkyminkcollection.com/uploads/1/3/0/7/130738841/8081179.pdf
    • http://bernardobellostudio.com/uploads/1/3/0/6/130639549/130639549.html#access+control+system+design+pdf
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013cf.bin
c56898e7372c9f6a087f7461fca61c8a214ee4039e16639e5a878ca6819ba4c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13CF 7164 bytes
font_01_sfnt_off00004fb4.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4FB4 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.