Malicious PDF — malware analysis report

Static analysis result for SHA-256 70b7d22ef0021917…

MALICIOUS

PDF

40.1 KB Authoring application: QPDF
MD5: 28c13d12c90e61fd1b067996bf9c5572 SHA-1: 3f62eb89ec3802c13adc76715c82284321b33585 SHA-256: 70b7d22ef0021917f250ca11f49c5409d57d7b3925bbfd64e0d9aa5daa6d1c96
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a pattern identified by the PDF_SEO_LINK_FARM heuristic. This suggests the document is designed to redirect users to a network of linked content, likely for malicious purposes such as SEO poisoning or distributing further malware. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tryshashby-rolls.com/uploads/1/3/0/6/130639461/5820224.pdf
    • http://www.tangovisions.be/uploads/1/3/0/6/130604678/vagaru.pdf
    • http://algrealproperties.com/uploads/1/3/0/8/130874391/weguvizokotedisaref.pdf
    • http://max.comppro.com/uploads/1/3/0/6/130603744/a87b1e.pdf
    • http://neeshazollinger.com/uploads/1/3/0/4/130490488/zixadino.pdf
    • http://jessicawcheung.com/uploads/1/3/0/8/130873971/lotosof.pdf
    • http://qor.kz/uploads/1/3/0/6/130621531/2472494.pdf
    • http://www.meetmoshe.com/uploads/1/3/0/7/130739153/cb538.pdf
    • http://staclaritasc.com/uploads/1/3/0/3/130323762/f6146b0.pdf
    • http://www.funredlabs.com/uploads/1/3/0/8/130814966/puresipefifen.pdf
    • http://autodiscover.oscilloscopemuseum.com/uploads/1/3/0/2/130291658/5329925.pdf
    • http://attiliosfarms.com/uploads/1/3/0/6/130605072/xorimopijet.pdf
    • http://letuscall.net/uploads/1/3/0/2/130272573/7335a7.pdf
    • http://smi-neurolab.org/uploads/1/3/0/5/130539940/voduxorap.pdf
    • http://petoskeydrones.com/uploads/1/3/0/7/130739828/vagunofe_nukatuk_razed_vibulukugo.pdf
    • http://ns.preservationdayton.com/uploads/1/3/0/6/130604882/fb21319336955.pdf
    • http://sales12-sip-phone.pleasingfood.com/uploads/1/3/0/8/130874055/130874055.html#outcomes+in+patients+with+adenoid+cystic+carcinoma+of+the+lacrimal+gland
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000337b.bin
41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x337B 2600 bytes
font_01_sfnt_off00003f4c.bin
fc0ca4ffcccaf3c4a882e7593addf45e1122dbcc0a59925625aad1fd638bd39b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3F4C 8828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.