Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b906cbd4a41998b…

MALICIOUS

PDF

36.6 KB Authoring application: QPDF
MD5: 2d65917934638c779e780c2635770a6c SHA-1: 0c0ba3c9d6c45131221555a8a4e2ea420c941e86 SHA-256: 7b906cbd4a41998b6b82f52249057ed14572eb30a82fbd75dc0f9aac961ad9d1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, aligning with the PDF_SEO_LINK_FARM heuristic.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ccsduplift.weebly.com/uploads/1/3/0/5/130540874/nalevakezozata.pdf
    • http://mcaroadsidedeals.com/uploads/1/3/0/6/130604441/lotusekir.pdf
    • http://unlawfullytasty.com/uploads/1/3/0/2/130270993/sujepem-fekejave.pdf
    • http://inshopper.site/uploads/1/3/0/4/130436196/9714329.pdf
    • http://lezadota.paypal-account-support.bz/uploads/2020/01/28/2320725.pdf
    • http://ken.jeanroyer.net/uploads/2020/01/27/japilobe.pdf
    • http://cleaningstgeorge.com/uploads/1/3/0/6/130605074/jemabunaturud.pdf
    • http://middleschoollessons.com/uploads/1/3/0/2/130289430/1024182.pdf
    • http://255alhambra.com/uploads/1/3/0/5/130589094/patelipovatiruv_mudumumubage_vijili_xudinexowabiza.pdf
    • http://neg.kangaroo-shop.ru/uploads/2020/01/28/latubuzemixarurafe.pdf
    • http://glammeshops.com/uploads/1/3/0/5/130589334/8130277.pdf
    • http://lofinab.volkanarslan.net/uploads/2020/01/28/demimukili_fujoxuvuxasu_gujobapeg_zenudajokip.pdf
    • https://segivupu.weebly.com/uploads/1/3/0/2/130291624/2607910.pdf
    • http://5pointauto.com/uploads/1/3/0/6/130639632/130639632.html#super+street+fighter+3+android+apk

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001418.bin
2edf654f1cd44f97663a66f7017cd142a89e8ca1cafb9230985ea65a71f815e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1418 9004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.