Malicious PDF — malware analysis report

Static analysis result for SHA-256 df3c6ad2e6f617be…

MALICIOUS

PDF

42.0 KB Authoring application: Solid Converter PDF
MD5: e7ecae70dc5723fe1f2a02b9d3c0552c SHA-1: 52be3e4a05e2e3531da54ead7ea47bb9a9038c1a SHA-256: df3c6ad2e6f617bee8b5b7142a7dd927495728ee1f93a4858f316221ce89f61a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. This suggests a link farm or SEO spam campaign. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hair-extension.info/uploads/2020/01/29/dugekazojepojos_nagimuz_koxefuruwup_vokotunixut.pdf
    • http://mimibug.com/uploads/1/3/0/2/130287893/vetenujura.pdf
    • http://addisonbeaux.com/uploads/1/3/0/3/130324170/8977461.pdf
    • http://mrgloballogistics.com/uploads/1/3/0/5/130550800/pupejepudik.pdf
    • http://cfirthwssu.com/uploads/1/3/0/5/130551661/xinisupomovunabafino.pdf
    • http://stanleycovington.com/uploads/1/3/0/4/130488092/2732d36d.pdf
    • http://moringanutritional.com/uploads/1/3/0/4/130488265/3003694.pdf
    • http://tintanegrahtx.com/uploads/1/3/0/5/130590139/gipixaxawanubajid.pdf
    • http://allaymedicinal.com/uploads/1/3/0/3/130379575/wowowolupom-kovikex-sedofer-winedaf.pdf
    • http://threeriverstax.com/uploads/1/3/0/5/130540567/4986036.pdf
    • http://silenusentertainment.com/uploads/1/3/0/5/130539759/6528475.pdf
    • http://pp-offer.info/uploads/2020/01/28/pulusavezulowis.pdf
    • http://danlynnwatt.com/uploads/1/3/0/5/130550809/6b6fe2feb2.pdf
    • http://palmettoroofingandexteriors.com/uploads/1/3/0/6/130621593/8156662.pdf
    • http://spectrumlifecare.net/uploads/1/3/0/5/130539179/ganitaxaga_tubakujisel_sokiwodi_dopazi.pdf
    • https://pikeguxi.weebly.com/uploads/1/3/0/5/130588503/lilode.pdf
    • http://fliphousesnotburgers.info/uploads/1/3/0/6/130620601/vugupivirawoboxav.pdf
    • http://pafepebul.opop777.icu/uploads/2020/01/29/3402535.pdf
    • http://junolele.lesperformance.net/uploads/2020/01/29/7263888.pdf
    • http://mindbodyhealthcoaching.com.au/uploads/1/3/0/5/130551434/20e67.pdf
    • http://gititazofu.sally-girl.pw/uploads/2020/01/27/tepomana.pdf
    • http://mltech.com.au/uploads/1/3/0/5/130588754/130588754.html#guided+reading+level+to+lexile
    • http://regiond.swe.org/uploads/1/3/0/2/130291838/31bf99e65afdba.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016c1.bin
b9969a84f2b0bfa0356eba77f4af14ef0f7562f4d6f50a3fd2da1177ec960bf9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16C1 8328 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.