Malicious PDF — malware analysis report

Static analysis result for SHA-256 66fa13f64b8bf08f…

MALICIOUS

PDF

34.5 KB Authoring application: Nitro PDF
MD5: f8b45070b39c7708e5b209b087e2e556 SHA-1: b3ca386da104caa989020b6e3e4d03354cb99cdb SHA-256: 66fa13f64b8bf08fcca53ed0bf617182c54b15ba787a08c16103fd41f1a79ef0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to distribute malicious content or manipulate search engine results. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent, likely related to phishing or traffic redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://web.expocristales.com/uploads/1/3/0/7/130739454/dc1c6d3.pdf
    • http://jacobsa.net/uploads/1/3/0/5/130589245/dazutosem.pdf
    • http://cartiercouturee.com/uploads/1/3/0/6/130620372/penajugapovasewixoz.pdf
    • http://drciarangrant.com/uploads/1/3/0/5/130589391/3e939b363.pdf
    • http://tropicalsealife.net/uploads/1/3/0/4/130476047/3673492.pdf
    • http://shannonmarieryan.com/uploads/1/3/0/6/130605159/zabosatirimimi-zodagovotama-tixevule.pdf
    • http://scriptcache.com/uploads/1/3/1/0/131071019/336731.pdf
    • http://cuberexpress.com/uploads/1/3/0/7/130776715/jumusigutakiwizuv.pdf
    • http://mineralcapital.net/uploads/1/3/0/7/130776874/kumadelefuxumuzotodu.pdf
    • http://recreationmgmt.com/uploads/1/3/0/6/130639683/tirijofoxerob.pdf
    • http://alisynmalek.net/uploads/1/3/0/5/130543025/213638.pdf
    • http://zofe.fr/uploads/1/3/0/3/130313363/rakawixowemosilum.pdf
    • http://de.jwoc.de/uploads/1/3/0/6/130604788/8e54aa75fb2.pdf
    • http://www.distinctivedesignsbytc.shop/uploads/1/3/0/4/130476605/somofisuzi.pdf
    • http://scob.ca/uploads/1/3/1/0/131070718/d49dec1c7dbd.pdf
    • http://www.rodcaines.com/uploads/1/3/0/6/130604597/c3f0d390cc.pdf
    • http://www.huntingdonifc.com/uploads/1/3/0/5/130551235/5838991.pdf
    • http://6iijoi.bdgct.com/uploads/1/3/0/5/130546136/3820198.pdf
    • http://www.montril.com/uploads/1/3/0/4/130483801/rifajezozotok.pdf
    • http://mollysteinwald.org/uploads/1/3/0/6/130640049/gipiwogavuj.pdf
    • http://radtacular.net/uploads/1/3/0/5/130588654/4437113.pdf
    • http://novayeastlabs.com/uploads/1/3/0/5/130588976/5578089.pdf
    • http://gayporn.onl/uploads/1/3/0/2/130289623/josekeborug.pdf
    • http://acouturelife.com/uploads/1/3/0/7/130739326/130739326.html#subject+verb+agreement+worksheets+with+answers+3rd+grade

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002628.bin
a188a8d8344ec3ab28be70619a822df44be985a98cc3124477b7ff940b60ad13		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2628 7268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.