Malicious PDF — malware analysis report

Static analysis result for SHA-256 870227bf3a449758…

MALICIOUS

PDF

35.9 KB Authoring application: GIMP
MD5: cf383b87a22c5eae09107b260ce5cd08 SHA-1: 9d9cfdff7ce327636423184134ef7443ab35b9c0 SHA-256: 870227bf3a449758c77a682abec0a723eaf1b1ba38153e38e60436aa99e33b72
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links likely lead to malicious websites, as indicated by the ClamAV detection and ML classifier. The document body appears to be obfuscated or corrupted, preventing a clear understanding of its specific lure, but the link farm strongly suggests a phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stepbucks.com/uploads/1/3/0/2/130291438/berefemawosob.pdf
    • http://www.goodamericandollars.com/uploads/1/3/0/7/130775654/tusixapit-pudawozowa.pdf
    • http://karajolevery.com/uploads/1/3/0/5/130539875/mikarawipunurorovo.pdf
    • http://scholarshipsandgrants.school/uploads/1/3/0/2/130287313/gozevodike_kumakeru_gelusurigezovir_denof.pdf
    • http://www.indiadominiqueross.com/uploads/1/3/0/4/130436173/5c5525e76.pdf
    • http://divinedwelling.org/uploads/1/3/0/3/130379770/pavor-kozodaritaxovuw-nidadisawubami-semadowixaja.pdf
    • http://alt-davos.club/uploads/1/3/0/5/130588426/986ddbf36f.pdf
    • http://betterworld.co.nz/uploads/1/3/0/2/130287313/854933.pdf
    • http://vinnybell.com/uploads/1/3/0/7/130739322/58ae121fb0b54.pdf
    • http://traderhsm.com/uploads/1/3/0/6/130605387/2802114.pdf
    • http://leanqueue.com/uploads/1/3/0/9/130969358/bifonejutarogivig.pdf
    • http://www.walkmedford.com/uploads/1/3/0/9/130969774/1345183.pdf
    • http://charleswagnerart.com/uploads/1/3/0/6/130621965/tumofuwalawexusuloli.pdf
    • http://host101.carmichaelnl.com/uploads/1/3/0/8/130874429/130874429.html#past+perfect+continuous+and+past+perfect+simple+examples

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000331a.bin
20e6d67334bab64d429c2fb4840a83b6af62e9aec24c6d2966f85e0ca9bc74bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x331A 7904 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.