Malicious PDF — malware analysis report

Static analysis result for SHA-256 68e8853593876509…

MALICIOUS

PDF

34.5 KB Authoring application: Soda PDF
MD5: 7daa2d4c92964d2729880af9e3db43f1 SHA-1: dc8e17be096138227efbd79bca42b6f350604a8e SHA-256: 68e88535938765098ef0b515ddaca20863894a26384c147488dc346694c9a8a2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a mass external link farm, directing users to numerous other PDF files hosted on various domains. This behavior is indicative of a phishing or malware distribution scheme, likely attempting to lure victims into downloading further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly supports this assessment.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://biltmorecreations.com/uploads/1/3/0/4/130435561/sowinad.pdf
    • http://danoboots.com/uploads/1/3/0/4/130488451/1756111.pdf
    • http://tattoosoritdidnthappen.com/uploads/1/3/0/5/130547078/pejibiwiviratab-niduridoxesivil-zazudijofi-vumikasukuzegef.pdf
    • http://laurakraftowitz.com/uploads/1/3/0/7/130739938/8860815.pdf
    • http://psorted.com/uploads/1/3/0/2/130272976/ac32ef4.pdf
    • http://mrvangeelsclass.com/uploads/1/3/0/6/130639124/4d9c2.pdf
    • http://www.benwatfordphoto.com/uploads/1/3/0/6/130640048/9670081.pdf
    • http://lanenafina.net/uploads/1/3/0/4/130475936/dawofimoduvovaw.pdf
    • http://ministermichealburton.com/uploads/1/3/0/4/130476850/831237c9b7b66e8.pdf
    • http://ministryops.net/uploads/1/3/0/8/130815124/2580737.pdf
    • http://marketingforsalessuccess.com/uploads/1/3/0/6/130622084/525335.pdf
    • http://bakerlawga.com/uploads/1/3/0/6/130604671/9657889.pdf
    • http://everyliving.com/uploads/1/3/0/7/130740259/xesasexenog.pdf
    • http://axolotl.co.vu/uploads/1/3/0/7/130776503/130776503.html#example+of+cover+letter+for+cv+uk

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e65.bin
07ae3da87f074c7f3a6ab1ca06ef54f21059d67470e64cb0fa369921be1b08d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E65 7784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.