Malicious PDF — malware analysis report

Static analysis result for SHA-256 cd0b470aaab892f4…

MALICIOUS

PDF

52.0 KB Authoring application: pdf-parser
MD5: 0c16d9a13ee53ed9186f1acd2da21d65 SHA-1: 9dd7376a6c56f945fbbfccfb1fd623d75309dbda SHA-256: cd0b470aaab892f4463b399ff83ddd0413e536122607979d3e953ddfb1034647
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, a technique often used for SEO spam or to direct users to malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The document body, though partially corrupted, contains references to IELTS reading passages and Adobe, suggesting a lure to potentially malicious content disguised as educational or legitimate material.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://903olive.com/uploads/1/3/0/6/130621113/sapixesezitug-guwulifumuweve.pdf
    • http://banifafeda.bazarym.com/uploads/2020/01/28/pavoxadiferanuke.pdf
    • http://refugechurchva.org/uploads/1/3/0/5/130543188/59e7d746ea6e.pdf
    • http://acherrymoon.com/uploads/1/3/0/2/130287930/6800285.pdf
    • http://gafof.kavkaz-car.ru/uploads/2020/01/27/26ade9a7ff18.pdf
    • http://newgaterva.com/uploads/1/3/0/6/130604350/rezepazije-movevisiduris.pdf
    • http://pnptogo.com/uploads/2020/01/28/3132458.pdf
    • http://everyday-sustainability.com/uploads/1/3/0/4/130435544/cfa783249487fd.pdf
    • http://jbweddingphotography.com/uploads/1/3/0/6/130621327/fesufibinirawof-lomaluzipat.pdf
    • https://jibubamesa.weebly.com/uploads/1/3/0/5/130538863/3899215.pdf
    • http://mquest.space/uploads/1/3/0/6/130639885/zarirupafi.pdf
    • http://tcsonline.net/uploads/1/3/0/5/130589346/130589346.html#time+travel+ielts+reading+passage+answers

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001302.bin
5a3b6334a73baa3cfb7c07155bf56d8beb3c5c4adead6bf6137f925303dc153a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1302 8376 bytes
font_01_sfnt_off00007bfd.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7BFD 16036 bytes
font_02_sfnt_off00009014.bin
e85238f5b2d23b53afc21fb4b7984e7dce0ca2bb4a70220c5cef224cec90116a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9014 2804 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.