Malicious PDF — malware analysis report

Static analysis result for SHA-256 7307ed61637c77b8…

MALICIOUS

PDF

36.3 KB Authoring application: PDFedit
MD5: 07c172fda5e5cac8cf84d583ded994b0 SHA-1: 9c36ca9ca2b5d8f09248b539998a28d6faece66a SHA-256: 7307ed61637c77b863fe5ccc626c21413a4d8dd13bd5787064ce556f2a5bea5c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to host malicious content. ClamAV detected this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a machine learning classifier also flagged it as malicious. No scripts were extracted, but the sheer volume of external links suggests a malicious intent to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.darkstarentertainment.net/uploads/1/3/0/4/130483319/4117790.pdf
    • http://headmastersgroup.com/uploads/1/3/0/6/130620506/rozabaz.pdf
    • http://jackielovesmusic.com/uploads/1/3/0/5/130539393/gunitovajir_nadesukibijuta_nosav_goretuwozurevu.pdf
    • http://vanlifedwelling.com/uploads/1/3/0/8/130873736/vafamiluxizeri-wotew.pdf
    • http://www.hagahlife.com/uploads/1/3/0/6/130604984/dilelizomo-jewomifib-nasejakodifi.pdf
    • http://retiprogram.org/uploads/1/3/0/2/130289467/8650107.pdf
    • http://webmail.phaseonedismantlingservices.com/uploads/1/3/0/4/130488983/fidipokudata.pdf
    • http://berryflats.net/uploads/1/3/0/5/130539218/4bfeade.pdf
    • http://copyright-form.com/uploads/1/3/0/5/130545199/04147f5e.pdf
    • http://referenceobscura.com/uploads/1/3/0/2/130272403/81014c.pdf
    • http://supplysol.com/uploads/1/3/0/6/130620687/9420854.pdf
    • http://scriptstitch.org/uploads/1/3/0/2/130289243/c52646eb81c.pdf
    • http://strigiformae.net/uploads/1/3/0/5/130543878/130543878.html#oops+concepts+in+java+durgasoft

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000035ad.bin
8a79eac434b22f57d23ed2f02d8790940e4c6369d3a8553ebe71c33b09af5431		 pdf-font-stream PDF embedded font (sfnt) at offset 0x35AD 7972 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.