Malicious PDF — malware analysis report

Static analysis result for SHA-256 cff961767198dfdf…

MALICIOUS

PDF

84.8 KB Authoring application: PDFedit
MD5: 2df8f9533ef45a824bb4f757d8f6629c SHA-1: a6aa4d756780937197311ccca7c500be0dcb3652 SHA-256: cff961767198dfdfc061309b13216d286b7245c7023eed8a6f8a119061313165
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically identified as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. No scripts were extracted, but the sheer volume of external links suggests a campaign to drive traffic to potentially compromised or malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://danducandu.com/uploads/1/3/0/7/130775897/9405040.pdf
    • http://www.lizastories.com/uploads/1/3/0/3/130312919/ximofuveba_wufegew_dosixasikodavis.pdf
    • http://platteparkchurch.org/uploads/1/3/0/6/130620150/wokusabawireso-repisugikazonom-parafozizibu-jamatozitizimig.pdf
    • http://creators.cool/uploads/1/3/0/8/130874213/739120.pdf
    • http://mrsrehm.com/uploads/1/3/0/6/130639780/gogiziladog_zepexupo_tolaze_tosewuropigipu.pdf
    • http://everydaymormongirl.com/uploads/1/3/0/2/130272278/9604283.pdf
    • http://mta-sts.mail.mantorvillain.com/uploads/1/3/0/4/130488839/a086438b1791.pdf
    • http://onlinewealthtools.net/uploads/1/3/0/5/130588500/add6dbfb3.pdf
    • http://aofcorp.com/uploads/1/3/0/5/130588256/5598169.pdf
    • http://glocalive.com/uploads/1/3/0/4/130492689/8326398.pdf
    • http://carrotmeetscookie.com/uploads/1/3/0/3/130324270/godoperakuduxa.pdf
    • http://www.bijouxdamour.net/uploads/1/3/0/6/130639258/7882182.pdf
    • http://cioga.com/uploads/1/3/0/5/130544385/libolovit.pdf
    • http://222-big-bon.site/uploads/1/3/0/6/130620852/kanikafikunikasa.pdf
    • http://taxnotaryprestamos.com/uploads/1/3/0/6/130622005/176f3263dece15c.pdf
    • http://trashedsf.com/uploads/1/3/0/4/130488483/7630976.pdf
    • http://reimaginingwellness.com/uploads/1/3/0/8/130813427/7382364.pdf
    • http://862.bpmtc.com/uploads/1/3/0/6/130621502/130621502.html#sustainable+agriculture+pdf+in+hindi
    • http://danducandu.com/uploa

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005b98.bin
20318449f40cd68632c25dd9b8fb735ab95e3245bcd25198c58fc80ad8957eea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5B98 9956 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.