Malicious PDF — malware analysis report

Static analysis result for SHA-256 74fb9baccee972db…

MALICIOUS

PDF

53.1 KB Authoring application: QPDF
MD5: 49a0fb9436328f244a284ff17775f45e SHA-1: 685e8e0e61fb934f27db26933400c517a83ddb28 SHA-256: 74fb9baccee972db3310356fd4ba133a33e84eed82c33e5bc2514df9c86a63b9
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and ML classifiers, exhibiting characteristics of a link farm or SEO manipulation. It contains a large number of embedded URLs pointing to other PDF files, suggesting a multi-stage distribution or redirection scheme. The document body itself is heavily obfuscated and contains some of the URLs, but its primary function appears to be hosting these malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.rotoruayachting.club/uploads/1/3/0/7/130776659/4ed00fb60c69f6.pdf
    • http://sporkbooks.com/uploads/1/3/0/6/130620880/3193491.pdf
    • http://extauto.com/uploads/1/3/0/6/130621200/186459.pdf
    • http://getitgatorauto.com/uploads/1/3/0/6/130621202/ff062d78e.pdf
    • http://neubacher.vafercapital.com/uploads/1/3/0/5/130588505/7614536.pdf
    • http://aifby.com/uploads/1/3/0/6/130604769/birolasefesifi-soxasozaxo.pdf
    • http://mobileboutiqueadriannemerkling.com/uploads/1/3/0/6/130620407/timozapa_bixinazutixo_tigozukujovu_naxofixesosikev.pdf
    • http://thebutchersarms.co.uk/uploads/1/3/0/3/130323814/316bccfe8f.pdf
    • http://scrummages.com/uploads/1/3/0/2/130291785/83830bf57.pdf
    • http://bellinghamlacrosse.com/uploads/1/3/0/5/130551994/rovuwowine.pdf
    • http://www.freedommedicalassociation.com/uploads/1/3/0/6/130620326/gojixuxobofodababeb.pdf
    • http://onhorn.com/uploads/1/3/0/5/130588565/2509794.pdf
    • http://tulsawindowtinter.com/uploads/1/3/0/6/130604477/b4b8b3776652.pdf
    • http://sparkmediasf.com/uploads/1/3/0/7/130739750/c22c4.pdf
    • http://surgestrategies.solutions/uploads/1/3/0/6/130621060/d84701ed06193b.pdf
    • http://kicknice.net/uploads/1/3/0/2/130288684/juviwaj.pdf
    • http://host67-131-77-214.static.ahcnm.org/uploads/1/3/0/6/130604009/wazepa.pdf
    • http://www.seclairer.com/uploads/1/3/0/4/130476712/530518.pdf
    • http://johnchadwick.com/uploads/1/3/0/2/130274322/sevelimipo.pdf
    • http://killzoneclan.com/uploads/1/3/0/8/130814623/kigate.pdf
    • http://hgssummerprograms.com/uploads/1/3/0/4/130435738/nexerom.pdf
    • http://footevolution.com/uploads/1/3/0/7/130740573/1168529.pdf
    • http://chrisbosgraaf.com/uploads/1/3/0/6/130620942/130620942.html#is+acrylamide+in+all+bread

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000ffc.bin
a2f2217faf7ebdf9f7188f3229883c58e1aaf53a7f8acc5fb66d82f9f2972f65		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFC 9676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.