Malicious PDF — malware analysis report

Static analysis result for SHA-256 b0d519ff743602ea…

MALICIOUS

PDF

37.4 KB Authoring application: Adobe PDF Library 9.0
MD5: 01a4b865a276cdbb9b3d20e019e486ce SHA-1: 062615d6248624e49b3ee92b5be7d95371514250 SHA-256: b0d519ff743602eaa7b1f3611400edff86ac388f743f7e245e795300004d8922
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to other PDF files, a technique often used for SEO manipulation or to distribute malicious content. ClamAV identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', suggesting a phishing or traffic redirection purpose. The ML classifier also strongly indicated maliciousness. No scripts were extracted, but the extensive link farm points to a delivery mechanism for further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://retrovideogamez.com/uploads/1/3/0/6/130604779/pixizamixusu.pdf
    • http://nevermoreacrespetrescueinc.com/uploads/1/3/0/3/130313345/236c37.pdf
    • http://michaeldeaton.com/uploads/1/3/0/5/130588731/4453349.pdf
    • http://michiganroofmasters.com/uploads/1/3/0/7/130776106/860307.pdf
    • http://periscopedigital.com.au/uploads/1/3/0/5/130540281/lebajasogifi.pdf
    • http://myautosaver.com/uploads/1/3/0/6/130604065/pejugo.pdf
    • http://nodina.brazilplan.club/uploads/2020/01/28/0b16de.pdf
    • http://ofwinitiative.com/uploads/1/3/0/6/130620982/94dffa27e8aa2.pdf
    • http://lolofashions.com/uploads/1/3/0/4/130489175/vakemu.pdf
    • http://organizaej.com/uploads/1/3/0/6/130603858/b40abaf0a054.pdf
    • http://lotusmediaprint.com/uploads/1/3/0/3/130379232/gazoxafipoguned_wogek.pdf
    • http://rechtspraak-republieknl-aarde.space/uploads/1/3/0/6/130604972/4578984.pdf
    • http://thehnossaproject.com/uploads/1/3/0/5/130551457/130551457.html#ableton+live+10+keyboard+stickers

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001348.bin
c8b192b2b132300fd607cc5aa17ff430c798ff394289b902e221ff5d327d826b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1348 9596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.