Malicious PDF — malware analysis report

Static analysis result for SHA-256 73dbf23ffcfa135d…

MALICIOUS

PDF

54.9 KB Authoring application: pstoedit First seen: 2020-09-24
MD5: 3f4c5731521a1187c74189db23270a44 SHA-1: 021cb1c4a5baf98f2b2be72b25ba4d20078cf001 SHA-256: 73dbf23ffcfa135d5ffe38620ccdb8593b826c50a1672744dcf1b7898320ab33
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF document flagged by ClamAV as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and exhibits a critical heuristic for a large number of external PDF links. The embedded URLs suggest a link farm designed to redirect users to various PDF files hosted on different domains. No scripts were extracted, but the sheer volume of outbound links indicates a malicious intent, likely related to SEO manipulation or redirecting users to potentially malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evolutiontaco.com/uploads/1/3/0/3/130379164/mikizefive.pdf In PDF document text
    • http://mrmacbible.org/uploads/1/3/0/5/130550869/bupekamemipuze.pdfIn PDF document text
    • http://mommyslittlewonders.com/uploads/1/3/0/5/130588997/guxovodap.pdfIn PDF document text
    • http://muthacluckaz.com/uploads/1/3/0/6/130639410/pebixazazenipaz.pdfIn PDF document text
    • http://309brightfuture.org/uploads/1/3/0/6/130604756/1725833.pdfIn PDF document text
    • http://alleylouisville.com/uploads/1/3/0/3/130323184/vumidaruxop.pdfIn PDF document text
    • http://wearejanedoe.com/uploads/1/3/0/5/130589237/fatulibo.pdfIn PDF document text
    • http://nunavikyouthhouseassociation.com/uploads/1/3/0/3/130379158/tozifisutorojoki.pdfIn PDF document text
    • http://smartlets.org/uploads/1/3/0/6/130620701/1837513.pdfIn PDF document text
    • http://airlinecity.com/uploads/1/3/0/5/130588772/226750.pdfIn PDF document text
    • http://www.cvillecohousing.com/uploads/1/3/0/8/130874031/lodazemez.pdfIn PDF document text
    • http://www.helphomeownership.com/uploads/1/3/0/6/130639055/favowofif-juzumixikigewi.pdfIn PDF document text
    • http://bbytransienthouse.com/uploads/1/3/0/7/130739234/rigoviwalutaze.pdfIn PDF document text
    • http://castillocoin.com/uploads/1/3/0/8/130874470/bepixixejo.pdfIn PDF document text
    • http://galenetics.org/uploads/1/3/0/7/130775879/d0fa65f007118e.pdfIn PDF document text
    • http://camacamp.org/uploads/1/3/0/7/130738841/bovuwuxoxonuvotas.pdfIn PDF document text
    • http://shelbycolgan.com/uploads/1/3/0/2/130270941/wixirine.pdfIn PDF document text
    • http://restonbiblechurch.net/uploads/1/3/0/2/130288753/dokumelegivavel.pdfIn PDF document text
    • http://webdisk.storgebhs.com/uploads/1/3/0/8/130874330/130874330.html#ayyappa+pooja+songs+lyrics+in+tamilIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d21.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D21 2884 bytes
SHA-256: b32f7d8da97bd9fa5aefa7b45be8d71de2c33adc0ee3093c5e3a4f9bded14115
font_01_sfnt_off00003b67.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3B67 6652 bytes
SHA-256: 7121c3dce08f736a744b1629b0c78160fc9dcf41e3768d8c527699a13d8f9ce8
font_02_sfnt_off00005536.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5536 24968 bytes
SHA-256: 73145b141ac8d3822ae1d7629ac0ec48b8df372cd225128773e57e54e70cfcc6

Open this report in the interactive analyzer, or submit your own file for analysis.