Malicious PDF — malware analysis report

Static analysis result for SHA-256 dfe02a8ad29cae9e…

MALICIOUS

PDF

34.3 KB Authoring application: ImageMagick
MD5: 0f95cbf1bb886d782197edd7267d15dd SHA-1: 32a69fc22b0a18b79f4889e45c83c4a351c7f0b9 SHA-256: dfe02a8ad29cae9e1868842cb1a06be41a2b66e6f781ab8334163432352a803b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF files hosted on Weebly. This is indicative of a link farm or SEO poisoning attack, designed to drive traffic to potentially malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support a malicious classification. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gibetaporabija.weebly.com/uploads/1/3/0/3/130323298/38e425.pdf
    • https://zunokekixus.weebly.com/uploads/1/3/0/4/130477805/kopojowupab.pdf
    • https://jizidovixob.weebly.com/uploads/1/3/0/4/130476344/wepukijenit.pdf
    • https://nejewafuno.weebly.com/uploads/1/3/0/3/130313262/4260412.pdf
    • https://xilozutife.weebly.com/uploads/1/3/0/4/130493893/palofoguwefuwi_lawuto.pdf
    • https://bokixelowafi.weebly.com/uploads/1/3/0/3/130313340/bfa6cb11dd.pdf
    • https://supanusug.weebly.com/uploads/1/3/0/4/130483132/fumixig.pdf
    • https://xitanaguxusiji.weebly.com/uploads/1/3/0/4/130476215/8553617.pdf
    • https://xeterivubaf.weebly.com/uploads/1/3/0/4/130488175/zozika.pdf
    • https://banugazezabikeg.weebly.com/uploads/1/3/0/5/130551981/nozodumozafib.pdf
    • https://soxopuzaxus.weebly.com/uploads/1/3/0/4/130476183/9624338.pdf
    • https://durosinev.weebly.com/uploads/1/3/0/4/130435766/130435766.html#grade+3+reading+comprehension+multiple+choice+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001214.bin
cf64481ff16459011a3e526d54d54a101b52e98b23fe6b1b227d5fccb2aff9bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1214 7400 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.