Malicious PDF — malware analysis report

Static analysis result for SHA-256 67f1070c1bbf67eb…

MALICIOUS

PDF

34.5 KB Authoring application: Adobe PDF Library 9.0
MD5: 3b7ae6496aa5abffa5c42b8ae19fdd46 SHA-1: 775ad0971aedd2a90f8749a9f6d46d812dc484cf SHA-256: 67f1070c1bbf67ebf089e02537f5e9b241f1b3251af3815bd410441692b1bf73
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also indicate maliciousness, specifically flagging it as phishing-related. The embedded URLs likely serve as a distribution mechanism for further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://midtrans.online/uploads/1/3/0/2/130287513/jidomirinogubuw-lokabo-xagepotad.pdf
    • http://growincome.net/uploads/1/3/0/5/130539105/1841a5b97.pdf
    • http://reachsports.net/uploads/1/3/0/2/130274091/61019.pdf
    • http://rudis-leadership.com/uploads/1/3/0/5/130550976/renafirofobig.pdf
    • http://mamaconference.org/uploads/1/3/0/4/130491079/disukuzevus.pdf
    • http://onepointsixoneeight.net/uploads/1/3/0/5/130538880/4657639.pdf
    • http://katharinaundsven.com/uploads/1/3/0/6/130605376/b20d2adcba76.pdf
    • http://electdavidharris.com/uploads/1/3/0/5/130550742/tirodamuxinij.pdf
    • http://www.graybeardadventure.com/uploads/1/3/0/5/130588320/rorusewejed-jotenufaveb-lozap-woruzawaxek.pdf
    • http://www.chedlee.com/uploads/1/3/0/2/130274146/bfd3f8a87bd.pdf
    • http://lloydspitalnikphotography.com/uploads/1/3/0/4/130477287/gubejebafil_visetixogafa.pdf
    • http://www.patrickmbruchert.com/uploads/1/3/0/6/130604815/4235227.pdf
    • http://monthlytights.net/uploads/1/3/0/6/130621938/5358775.pdf
    • http://74-123-72-249.mgwnet.com/uploads/1/3/0/4/130436014/130436014.html#abdominal+strengthening+exercises+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000308f.bin
9088ff756a2c5d4e35f68960f50c6a4c044fbf4ad403537577f6fb8b8d6d88db		 pdf-font-stream PDF embedded font (sfnt) at offset 0x308F 6904 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.