Malicious PDF — malware analysis report

Static analysis result for SHA-256 807330aef1022d8a…

MALICIOUS

PDF

37.8 KB Authoring application: Poppler-utils
MD5: e654c81657c258d5895d5774929870f1 SHA-1: 2dc311d07e208d9b6e7b6389bcd2c432b14a4b56 SHA-256: 807330aef1022d8a4576b31a94a0eee0e7a69c15197ec9426901e01726828caf
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malicious payloads. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a machine learning classifier also flagged it as malicious. The embedded URLs suggest a pattern of redirecting users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://desert-snow.com/uploads/1/3/0/3/130312965/99ca22.pdf
    • http://dawn-group.co.uk/uploads/1/3/0/6/130640114/nakutoxukoxoda.pdf
    • http://nabeelreviews.com/uploads/1/3/0/3/130323250/solopijuk.pdf
    • http://vajessholden.com/uploads/1/3/0/6/130621134/ab08a5452.pdf
    • http://www.foundationalparenting.org/uploads/1/3/0/2/130271042/d2a26bb98639.pdf
    • http://remodelingfuel.net/uploads/1/3/0/6/130621847/xujubarigogosa-sikaz.pdf
    • http://oclacrosse.net/uploads/1/3/0/7/130776273/gozipexo-finigifinifuluw-zananid.pdf
    • http://mmshop.club/uploads/1/3/0/2/130288559/7eaece1289278d.pdf
    • http://pensacolapetcommunity.com/uploads/1/3/0/7/130739232/piroke-maguw.pdf
    • http://myrnaphillips.com/uploads/1/3/0/6/130621324/rututinowilax.pdf
    • http://featherfallsmobileestates.com/uploads/1/3/0/2/130288909/17fb10ab22d31.pdf
    • http://margeauxsplace.net/uploads/1/3/0/7/130775387/8ba612c18f1e5.pdf
    • http://alexapeters.com/uploads/1/3/0/5/130544387/bowudim.pdf
    • http://cupertinoonlinenews.com/uploads/1/3/0/3/130379549/konijesenar.pdf
    • http://darengallo.com/uploads/1/3/0/4/130489346/gofivuvu-jeponurab-siraka-vipawoj.pdf
    • http://growmichiganchurches.com/uploads/1/3/0/4/130488100/c954b7.pdf
    • http://whm.sayezz.com/uploads/1/3/0/7/130775355/kusegarowusek-zasugeju-belafebidavi-bupiso.pdf
    • http://pinklilyjewelry.com/uploads/1/3/0/5/130545485/bexime.pdf
    • http://grantediting.net/uploads/1/3/0/6/130639787/1901647.pdf
    • http://pjocib.bdgct.com/uploads/1/3/0/3/130313049/130313049.html#bronchial+asthma+in+acute+exacerbation+ppt

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000342a.bin
f29cdcbb08aab679650b94fa353904c207f99f5cbe620d7ad51d56d91c039590		 pdf-font-stream PDF embedded font (sfnt) at offset 0x342A 8232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.