Malicious PDF — malware analysis report

Static analysis result for SHA-256 731fd540a33ea773…

MALICIOUS

PDF

45.4 KB Authoring application: SWFTools
MD5: d939aab5e15f917ee6329732934cac0c SHA-1: 88a41f89b4f52db96635087a0a6c33edfaa90baf SHA-256: 731fd540a33ea77381cabb18627f8c5cf86acad9a0fcd6b1f725eebcbcc46b33
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of links to external PDF files hosted on various domains, indicating a link farm designed to distribute malicious content or conduct phishing. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware delivery. No scripts were extracted, but the embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://motta-ddd.pl/uploads/1/3/0/2/130270924/4d90101de7.pdf
    • http://meetelizabethanderson.com/uploads/1/3/0/8/130873771/6342362.pdf
    • http://silentreviews.com/uploads/1/3/0/2/130288380/nexokebujiju.pdf
    • http://bortanfabrics.com/uploads/1/3/0/2/130291030/gojisafaponobume.pdf
    • http://sadiths.com/uploads/1/3/0/3/130323774/b7da004dc83.pdf
    • http://potentevisuals.com/uploads/1/3/0/2/130289163/rululegilog.pdf
    • http://grownmoney.org/uploads/1/3/0/3/130323322/bipuvubalasuki.pdf
    • http://fallinglava.com/uploads/1/3/0/8/130874324/giseler.pdf
    • http://sarahshockley.com/uploads/1/3/0/9/130969481/945317.pdf
    • http://kootenaycured.com/uploads/1/3/0/4/130435757/feloxiwi_wibumeguwiberoz_noxodirufeno.pdf
    • http://angelahardison.online/uploads/1/3/0/6/130639479/xexejexatave.pdf
    • http://thetitanlawn.com/uploads/1/3/0/5/130547884/fukozofirat_fenusupujefo_xebibanizejojig_ritexuguxuguf.pdf
    • http://desatascossantfeliudellobregat.com/uploads/1/3/0/6/130603688/jimolifanopazex-samuwejikopevas-fukowoxofazof-pamawurujos.pdf
    • http://74-123-76-231.mgwnet.com/uploads/1/3/0/5/130551181/130551181.html#school+vocabulary+esl+activities
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004048.bin
f31c439e28d0137206b91a151f21343900f846ed9ff070250fbe82eb1cc7da1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4048 16204 bytes
font_01_sfnt_off00005852.bin
74c86e49696bd3190e4e6322cd5968e852ffc7bbba4c473470b93dc3c7086183		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5852 8064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.