Malicious PDF — malware analysis report

Static analysis result for SHA-256 d0d5ab76162414a9…

MALICIOUS

PDF

46.9 KB Authoring application: Smallpdf Desktop
MD5: 998bd9e8ac2bb33905d9b41129037652 SHA-1: a328091aaa3b2885928844b568106aa21db665f4 SHA-256: d0d5ab76162414a9ff390d4845695f293955bbce1c00044478cf4259bfbea6df
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection as Pdf.Phishing.TtraffRobotInstall. The document body contains a large number of external URLs, suggesting a phishing or redirection attempt. The primary purpose appears to be to lure users to these external sites, which are likely hosting malicious content or further phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://downundermigration.com/uploads/1/3/0/3/130313748/8851712.pdf
    • http://genumelab.ecpn.su/uploads/2020/01/28/8037705.pdf
    • http://rowanprssa.com/uploads/1/3/0/2/130291724/logujixeme.pdf
    • http://my-bizco.com/uploads/1/3/0/5/130588560/lelovovagil_magimuj_xenipiladiki_xotefolufaxi.pdf
    • http://onelasttreat.org/uploads/1/3/0/5/130551728/jogeg.pdf
    • http://northbeavercontracting.net/uploads/1/3/0/4/130483109/1989695.pdf
    • http://jifisuw.highchance.top/uploads/2020/01/28/jipigonefud.pdf
    • http://kinderdagverblijfzandopdemat.nl/uploads/1/3/0/5/130546283/valato.pdf
    • http://policetrailer.com/uploads/1/3/0/4/130477170/130477170.html#2nd+line+apk+area+code

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011e2.bin
564f3e466df8164e2120aa88f57c2df1cb905ace2b85bc7abfa7a4a96d3bd02f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E2 9108 bytes
font_01_sfnt_off00006495.bin
da576065be64f3e937390e224799850b0930f00402f72df6ce46925e85301654		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6495 6668 bytes
font_02_sfnt_off000070b4.bin
c6c28444bcd94379862b6cc7f8cfcdbcdaeb026857ccdb099d87626a561054a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x70B4 16092 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.