Malicious PDF — malware analysis report

Static analysis result for SHA-256 79f9045413b8d376…

MALICIOUS

PDF

44.8 KB Authoring application: PDF Studio
MD5: 900e658a705541f94ef6320d9c0be0f2 SHA-1: d292eed3a647da9c1ee56b02470eb4f295d1f149 SHA-256: 79f9045413b8d376ad57faf10eb47a3e06d34863f16cf0be92c301ab582346bf
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and a ClamAV detection for phishing. The embedded content, though heavily obfuscated, appears to be part of a lure, and the numerous external links likely lead to malicious or phishing content. The primary attack pattern involves leveraging a large number of external links to distribute malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://zenoclinical.com/uploads/1/3/0/2/130272856/c9c0597.pdf
    • http://kexig.rusfermer.info/uploads/2020/01/28/6239585.pdf
    • http://worldwidegreatescapes.com.au/uploads/1/3/0/5/130539316/5288e92362aa.pdf
    • http://nghomeimprovment.com/uploads/1/3/0/6/130639175/161224bc2d8.pdf
    • http://connectingcoffee.com/uploads/1/3/0/5/130544898/wemuvagimimuxonutepu.pdf
    • http://dongoad.com/uploads/1/3/0/7/130775831/bivopiju.pdf
    • http://valetudo.life/uploads/1/3/0/6/130620543/4128614.pdf
    • http://thepoopbucket.com/uploads/1/3/0/2/130287284/duzerakilazed.pdf
    • http://myplayergrind.com/uploads/1/3/0/3/130379074/giwibukina.pdf
    • http://blubloggs.com/uploads/1/3/0/4/130488698/ec5a77dafc495.pdf
    • http://subjectiveself.net/uploads/1/3/0/5/130539131/5adb0923161.pdf
    • http://vicinv.net/uploads/1/3/0/2/130289296/modunod-dapirubomawutij-posozamanitu-lixevupuvizo.pdf
    • http://woodlandstuition.com/uploads/1/3/0/6/130639272/130639272.html#gta+san+andreas+cheats+apk+mirror
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000137f.bin
05e53b7a5adff07439fe1faa57d2e21d9684a260475b1b612471270a4f7566b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x137F 9108 bytes
font_01_sfnt_off00006916.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6916 16036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.