Malicious PDF — malware analysis report

Static analysis result for SHA-256 ddfde99386c3e74d…

MALICIOUS

PDF

47.0 KB Authoring application: PDFedit First seen: 2021-06-30
MD5: 583aa4be816c082f2b14f505b48f6aa2 SHA-1: 3dc42739ae3c41bb0d65fbb664c5fd8587ae7a5a SHA-256: ddfde99386c3e74dedef38c35ec03eef5f4ac269dd7ad10f3f182d55ed391533
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The PDF contains a large number of embedded external links, identified as a 'PDF_SEO_LINK_FARM', pointing to various PDF and HTML files hosted on different domains. This suggests a tactic to distribute malicious content or manipulate search engine results. While no scripts were explicitly extracted, the nature of the embedded links and the heuristic findings strongly suggest a phishing or malware distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dcepool.net/uploads/1/3/0/3/130379287/3f40ffa7f4.pdf In PDF document text
    • http://zirma.com/uploads/1/3/0/6/130620976/fozukukikafodojer.pdfIn PDF document text
    • http://garaboleri.simptomi.info/uploads/2020/01/28/texojas_sunodidijalov_depukitoluki.pdfIn PDF document text
    • http://mrsjessinaanderson.com/uploads/1/3/0/5/130589020/zaxigunuxigov.pdfIn PDF document text
    • http://remodelkitchenbathroom.com/uploads/1/3/0/7/130739211/7119116.pdfIn PDF document text
    • http://schoolchoicevermont.com/uploads/1/3/0/3/130379132/9400830.pdfIn PDF document text
    • http://noblecountylibrary.com/uploads/1/3/0/5/130588928/nenividoloxevar_bugubidudux_lubes_jawokig.pdfIn PDF document text
    • http://watestingllc.shop/uploads/1/3/0/6/130621582/130621582.html#2001+audi+tt+longitudinal+acceleration+sensor+locationIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011e0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11E0 8720 bytes
SHA-256: 60489ebd2450a8364f9570179c3f19ce5bf746e913c0b8257602ff1a5656ccb0

Open this report in the interactive analyzer, or submit your own file for analysis.