Malicious PDF — malware analysis report

Static analysis result for SHA-256 783de0981221fbe1…

MALICIOUS

PDF

36.8 KB Authoring application: Soda PDF
MD5: 1c502969f2dc1f7888aff252a7d676cb SHA-1: 5846c43740787b1d1f304339bbb77ed62d58ac81 SHA-256: 783de0981221fbe1a69acad9e34e61868b58af1a4a89d44613f4462a1909b0e5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute further malicious content. ClamAV detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection scheme. No scripts were extracted, but the embedded URLs are the primary indicators of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://carrieebens.com/uploads/1/3/0/7/130739082/0d15b8d6.pdf
    • http://economicsinmotion.org/uploads/1/3/0/6/130603836/48af60975d.pdf
    • http://allthingscpr.com/uploads/1/3/0/5/130589049/gejenonada.pdf
    • http://patrickjbryan.com/uploads/1/3/0/2/130288559/funuxukifuk.pdf
    • http://travelbymrsv.com/uploads/1/3/0/2/130289315/6587891.pdf
    • http://thescentedsheep.com/uploads/1/3/0/6/130603783/wikowebujol.pdf
    • http://www.theesthers.org/uploads/1/3/0/7/130739951/cac56b63eeca078.pdf
    • http://allahand.com/uploads/1/3/0/7/130739340/3288407.pdf
    • http://tastetravels.com/uploads/1/3/0/3/130324370/worakobezegina-tobupugukuz.pdf
    • http://greesnborodoorinstaller.com/uploads/1/3/0/3/130312976/nijuxifilejas.pdf
    • http://pepperminttrail.com/uploads/1/3/0/6/130620429/lebulejadozamex.pdf
    • http://thaddeusnhizfamily.com/uploads/1/3/0/6/130640048/e270cde34a1.pdf
    • http://theatlantadoula.com/uploads/1/3/0/4/130483986/noforej.pdf
    • http://acgr.info/uploads/1/3/0/8/130874045/d0d53.pdf
    • http://nomorejoemoore.com/uploads/1/3/0/5/130550838/5725817.pdf
    • http://jujz.net/uploads/1/3/0/4/130488569/4260ef58.pdf
    • http://celesteenriquez.com/uploads/1/3/0/2/130289282/masixiz.pdf
    • http://ombeat.app/uploads/1/3/0/5/130550974/67c9e097f13.pdf
    • http://avabaycompany.com/uploads/1/3/0/4/130476145/130476145.html#agilent+gc+inlet+types

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003391.bin
2748eecd8b19db74a77841afd09ee51a602100dfc95de124724d9b7f7ff7b7d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3391 7568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.