Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c9fdb96f22ad580…

MALICIOUS

PDF

54.4 KB Authoring application: PDFBox
MD5: 41705af1099e2dd08abecf7c282da232 SHA-1: b238564b3daada661deb187550568eab4dd09384 SHA-256: 6c9fdb96f22ad5800bca6e4a8651e23ea55c92bf65d17a49dbd044908be8dbe5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. ClamAV also identified this as Pdf.Phishing.TtraffRobotInstall, indicating a phishing or malicious distribution intent. The embedded URLs suggest a campaign to redirect users to potentially malicious content or to manipulate search engine rankings.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://326mountainroad.com/uploads/1/3/0/5/130589252/voxexegiz-noxola-kumiretefid-segodofamefosu.pdf
    • https://gowabonebopuluv.weebly.com/uploads/1/3/0/2/130289690/nebunu.pdf
    • http://anadiproperty.com/uploads/1/3/0/2/130289410/bemiredutejem.pdf
    • http://grantluther.com/uploads/1/3/0/4/130435673/gorupep.pdf
    • http://mind4age.org/uploads/1/3/0/6/130604049/1141092.pdf
    • http://nickreese.net/uploads/1/3/0/5/130588461/zegereraluwejamedig.pdf
    • http://deardoc.org/uploads/1/3/0/4/130476703/1aaba259f00dec7.pdf
    • http://baypointvillas.com/uploads/1/3/0/6/130639980/d9a2a34d.pdf
    • http://creativemindsa2z.shop/uploads/1/3/0/6/130621215/rowed_xaposokupedok.pdf
    • http://bestbroadbandsupplier2019.co.uk/uploads/1/3/0/2/130291809/pisesonaganutagexana.pdf
    • http://shardexplorers.com/uploads/1/3/0/4/130483806/130483806.html#website+templates+dark+blue

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011a7.bin
2f31fe6d16628897d81ce2a4b901121b3a4e1e845d344507dd393e199b71a054		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A7 8220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.