Malicious PDF — malware analysis report

Static analysis result for SHA-256 750403ef4292fab9…

MALICIOUS

PDF

38.4 KB Authoring application: PDF Studio
MD5: 04f31c571beb44268980021bc7e5dcf2 SHA-1: 85b39dde7286a849674855169676e8405631b3c8 SHA-256: 750403ef4292fab9e555ea61acfe622d4fb867245c7fbf6af686aba31cce5cdc
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. No scripts were extracted, but the sheer volume of linked PDFs suggests a coordinated effort to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sweetonketobakery.com/uploads/1/3/0/2/130289774/tulajavar-tanom-xemag.pdf
    • http://www.autumnharvestaustralianlabradoodles.com/uploads/1/3/0/7/130775563/6d95803.pdf
    • http://vicinv.net/uploads/1/3/0/5/130588954/jirefo.pdf
    • http://2020cruises.com/uploads/1/3/0/3/130323997/xigoruvokovitux.pdf
    • http://blamedickens.com/uploads/1/3/0/6/130605089/4142739.pdf
    • http://maephimbeaches.com/uploads/1/3/0/4/130476351/d62789e6b1c6f.pdf
    • http://renegadegreens.com/uploads/1/3/0/2/130288729/1623415.pdf
    • http://bubblebag-australia.net/uploads/1/3/0/5/130543985/rogatidafisogu.pdf
    • http://hostmaster.creative-economy-africa.org.uk/uploads/1/3/0/2/130289746/8902684.pdf
    • http://cpanel.quietmindfdn.org/uploads/1/3/0/3/130313262/3040780.pdf
    • http://restaurantbeaumonde.com/uploads/1/3/0/7/130739923/ab697e995a3b.pdf
    • http://keetolove.com/uploads/1/3/0/7/130775506/3897035.pdf
    • http://natureinnny.org/uploads/1/3/0/5/130551611/7992709.pdf
    • http://postmaster.autoneltempo.com/uploads/1/3/0/7/130775244/xamupodasegowida.pdf
    • http://pyschicnetwork.live/uploads/1/3/0/2/130270918/6460345.pdf
    • http://www.justgetfitwithjessfit.com/uploads/1/3/0/2/130289262/7744373.pdf
    • http://www.hopeinthearts.com/uploads/1/3/0/2/130288316/zixupo-butetim.pdf
    • http://merchantsacceptance.net/uploads/1/3/0/5/130588195/liporux.pdf
    • http://amviciouslashes.com/uploads/1/3/0/7/130740513/532014a5.pdf
    • http://koozieorbust.com/uploads/1/3/0/6/130622033/bonixudujitani-xukad-bizasa-mupujapazakabaf.pdf
    • http://noahsusskind.net/uploads/1/3/0/4/130489275/239744a8.pdf
    • http://meublerenaissance.com/uploads/1/3/0/7/130740563/4413849.pdf
    • http://mkervra.com/uploads/1/3/0/7/130776054/jisaga.pdf
    • http://763rl.slpny.com/uploads/1/3/0/7/130739889/130739889.html#acca+p7+past+paper+december+2012

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030d4.bin
23ebfbfbb71e522387d8b61e1fcbfc8fc2654997952c68dd5f609aa5a013ec0d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30D4 8828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.