Malicious PDF — malware analysis report

Static analysis result for SHA-256 73dbf23ffcfa135d…

MALICIOUS

PDF

54.9 KB Authoring application: pstoedit
MD5: 3f4c5731521a1187c74189db23270a44 SHA-1: 021cb1c4a5baf98f2b2be72b25ba4d20078cf001 SHA-256: 73dbf23ffcfa135d5ffe38620ccdb8593b826c50a1672744dcf1b7898320ab33
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The sample is a PDF document flagged by ClamAV as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and exhibits a critical heuristic for a large number of external PDF links. The embedded URLs suggest a link farm designed to redirect users to various PDF files hosted on different domains. No scripts were extracted, but the sheer volume of outbound links indicates a malicious intent, likely related to SEO manipulation or redirecting users to potentially malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://evolutiontaco.com/uploads/1/3/0/3/130379164/mikizefive.pdf
    • http://mrmacbible.org/uploads/1/3/0/5/130550869/bupekamemipuze.pdf
    • http://mommyslittlewonders.com/uploads/1/3/0/5/130588997/guxovodap.pdf
    • http://muthacluckaz.com/uploads/1/3/0/6/130639410/pebixazazenipaz.pdf
    • http://309brightfuture.org/uploads/1/3/0/6/130604756/1725833.pdf
    • http://alleylouisville.com/uploads/1/3/0/3/130323184/vumidaruxop.pdf
    • http://wearejanedoe.com/uploads/1/3/0/5/130589237/fatulibo.pdf
    • http://nunavikyouthhouseassociation.com/uploads/1/3/0/3/130379158/tozifisutorojoki.pdf
    • http://smartlets.org/uploads/1/3/0/6/130620701/1837513.pdf
    • http://airlinecity.com/uploads/1/3/0/5/130588772/226750.pdf
    • http://www.cvillecohousing.com/uploads/1/3/0/8/130874031/lodazemez.pdf
    • http://www.helphomeownership.com/uploads/1/3/0/6/130639055/favowofif-juzumixikigewi.pdf
    • http://bbytransienthouse.com/uploads/1/3/0/7/130739234/rigoviwalutaze.pdf
    • http://castillocoin.com/uploads/1/3/0/8/130874470/bepixixejo.pdf
    • http://galenetics.org/uploads/1/3/0/7/130775879/d0fa65f007118e.pdf
    • http://camacamp.org/uploads/1/3/0/7/130738841/bovuwuxoxonuvotas.pdf
    • http://shelbycolgan.com/uploads/1/3/0/2/130270941/wixirine.pdf
    • http://restonbiblechurch.net/uploads/1/3/0/2/130288753/dokumelegivavel.pdf
    • http://webdisk.storgebhs.com/uploads/1/3/0/8/130874330/130874330.html#ayyappa+pooja+songs+lyrics+in+tamil
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d21.bin
b32f7d8da97bd9fa5aefa7b45be8d71de2c33adc0ee3093c5e3a4f9bded14115		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D21 2884 bytes
font_01_sfnt_off00003b67.bin
7121c3dce08f736a744b1629b0c78160fc9dcf41e3768d8c527699a13d8f9ce8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B67 6652 bytes
font_02_sfnt_off00005536.bin
73145b141ac8d3822ae1d7629ac0ec48b8df372cd225128773e57e54e70cfcc6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5536 24968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.