Malicious PDF — malware analysis report

Static analysis result for SHA-256 7c766cda1c34d300…

MALICIOUS

PDF

40.1 KB Authoring application: pdf-parser
MD5: 693f58b705041872e0f7331cb9c40654 SHA-1: 5b5cb3c6a52aea4dc71204ca9e4845f088499f46 SHA-256: 7c766cda1c34d30029c1ac36911a319352e230be8e772918446c64ec9ae94e49
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded URLs, indicative of a link farm designed to redirect users to potentially malicious content. ClamAV detected this as Pdf.Phishing.TtraffRobotInstall, and a machine learning classifier also flagged it as malicious. The embedded URLs are the primary indicators of compromise, suggesting a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://studiocitynorth.com/uploads/1/3/0/3/130323672/nexatifom-nodujupo-mitusufevot-finosozixifim.pdf
    • http://mixedattainmentteaching.com/uploads/1/3/0/5/130590393/2438791.pdf
    • http://stroicomplexnn.ru/uploads/2020/01/27/warasok.pdf
    • http://shields-data.com/uploads/1/3/0/5/130540017/3cbea60748eb8.pdf
    • http://alexandraresmerita.eu/uploads/1/3/0/4/130483591/4916451.pdf
    • http://genedi.transcom78.ru/uploads/2020/01/27/9a22b0aafd4c.pdf
    • http://counter-truth.com/uploads/1/3/0/4/130490776/4608106.pdf
    • http://antonioflowers919.com/uploads/1/3/0/3/130324126/6921676.pdf
    • http://onnellisuuskoulu.net/uploads/1/3/0/4/130478704/f6254826.pdf
    • http://agapanthus-plants.com/uploads/1/3/0/6/130620651/vumuv.pdf
    • http://unnimo.no/uploads/1/3/0/5/130589144/5236766.pdf
    • http://keplex.us/uploads/1/3/0/4/130490314/477929470bcf0c.pdf
    • http://asisuppliermarketing.com/uploads/1/3/0/6/130604209/gizanejopunejil_dewubisud_korawobafugoxu.pdf
    • http://bewellmindset.net/uploads/1/3/0/5/130543991/maredizajaneru-vipetugebap-volivusitogimu.pdf
    • http://wusareputo.notaorg.ru/uploads/2020/01/27/b9971c56d95d910.pdf
    • http://resatiwixo.best-shanson.ru/uploads/2020/01/27/4e2540579150.pdf
    • http://bigotheoryclub.weebly.com/uploads/1/3/0/2/130291624/temimixubiro.pdf
    • http://david-arnebeck-news.com/uploads/1/3/0/5/130538956/lutuxof.pdf
    • http://rewowuzo.qq10qq.top/uploads/2020/01/27/pedivuwuvetisu_kutiv_mejubijofi.pdf
    • http://mysunfast3200.com/uploads/1/3/0/6/130603971/130603971.html#dragalia+wyrmprint+guide+reddit

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015c3.bin
e0538ccaec88c832d42c760193886558d5727c36ebd1f3a613bdc55f0ad36102		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15C3 7816 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.