Malicious PDF — malware analysis report

Static analysis result for SHA-256 bfaaac3045a1386d…

MALICIOUS

PDF

32.8 KB Authoring application: Smallpdf Desktop
MD5: fddcc62490e2ac39b9919392ad82bc73 SHA-1: 3e06c61475091963f84c2c0e5bd7515bf309fe67 SHA-256: bfaaac3045a1386d121ed6df3ca4be642e2d0cd201eeca0501ad95220275ef6b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to other PDF files, a technique commonly used for SEO poisoning and phishing lures. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The document body, though partially corrupted, contains references to medical codes and URLs, suggesting a pretext to trick users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kotlinforums.com/uploads/1/3/0/5/130541597/4504294.pdf
    • http://sassyscraps.com.au/uploads/1/3/0/7/130739369/fegezalupuli.pdf
    • http://shahwar.com/uploads/1/3/0/7/130738850/gekewasa-defatupoviz-kamatimokeb-bewepebodalun.pdf
    • http://mrsrehm.com/uploads/1/3/0/8/130873868/fopaful_numuralogajenu_javajazozal_mutoxupojef.pdf
    • http://edgepainting.co.nz/uploads/1/3/0/4/130436163/2112618.pdf
    • http://hostmaster.twinefilms.com/uploads/1/3/0/5/130551986/8980330.pdf
    • http://paddleboardannamaria.com/uploads/1/3/0/8/130814645/75138.pdf
    • http://lakecountyrecovers.org/uploads/1/3/0/2/130287495/a96a9a6.pdf
    • http://bulldogcleaningandrestoration.com/uploads/1/3/0/6/130620268/4161153.pdf
    • http://joeblitzstein.net/uploads/1/3/0/6/130620982/vazilaros.pdf
    • http://vps18.pleasingfood.com/uploads/1/3/0/4/130483087/130483087.html#icd+10+code+for+lumbosacral+spondylolisthesis

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002a74.bin
eb9586262249245adb79d2a26d8b8d3cc0790cb037ac31f9afb639d95a181832		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2A74 7692 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.