Malicious PDF — malware analysis report

Static analysis result for SHA-256 e42dd7ff80b11aba…

MALICIOUS

PDF

39.7 KB Authoring application: Smallpdf Desktop
MD5: 978aba731bf0dfcd9bed5d7df2531673 SHA-1: ac8762d0a78e38b778e53c2ce49838cda986b29d SHA-256: e42dd7ff80b11aba985f2c3d31335c5288f6f125bf9c2311388dfcd2c1a3a547
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links to other PDFs hosted on various domains, a technique often used for SEO poisoning or phishing. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support a malicious classification. The embedded URLs suggest a link farm designed to redirect users to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nccatnec.weebly.com/uploads/1/3/0/4/130488073/resuzakop.pdf
    • http://capitaosp.com/uploads/1/3/0/5/130590391/zerusatixad.pdf
    • http://amadorah.com/uploads/1/3/0/5/130590511/75f9c068d621.pdf
    • http://fapuzi.kakluchshe.com/uploads/2020/01/28/9337747.pdf
    • http://misiupapier.com.au/uploads/1/3/0/6/130621152/gusinozutak.pdf
    • http://r-notes.weebly.com/uploads/1/3/0/5/130550881/ximazujijuzogunuw.pdf
    • http://myblackenterprise.com/uploads/1/3/0/4/130476180/1117923.pdf
    • http://livoxov.bp-bas.com/uploads/2020/01/29/dulipuvuviturame.pdf
    • http://northpacifictrainingperformanceinc.com/uploads/1/3/0/5/130540211/247b1ec.pdf
    • http://milieu-art.com/uploads/1/3/0/6/130603822/74f62fd0e542cfe.pdf
    • http://cairokhanhotel.net/uploads/1/3/0/6/130620798/fakujeba-bipebadezoz-lagubumike-wamiratusat.pdf
    • http://mommytimeindoorplay.com/uploads/1/3/0/6/130620651/govosekilu.pdf
    • http://townofclermont.com/uploads/1/3/0/2/130289259/6517204.pdf
    • http://davesroofingmaine.com/uploads/1/3/0/3/130379172/zotifiv-nisivajugoxijud-fafumus.pdf
    • http://weefca.com/uploads/1/3/0/3/130313489/velorud-jufemot-xasiruveviruja-xakovaf.pdf
    • http://iweargreatness.com/uploads/1/3/0/5/130552106/2653543.pdf
    • http://braasch-sicherheit.com/uploads/1/3/0/6/130604305/721af5.pdf
    • http://micklos.net/uploads/1/3/0/4/130488432/d1a456856e6.pdf
    • http://kchcapital.com/uploads/1/3/0/5/130543256/salalujexepiri.pdf
    • http://beautyefx.com/uploads/1/3/0/3/130313671/juzuw.pdf
    • http://miandhepiano.com/uploads/1/3/0/2/130288522/6d359.pdf
    • http://stillwellsalesllc.com/uploads/1/3/0/4/130477541/7731842.pdf
    • http://freeseomagic.com/uploads/1/3/0/4/130490719/wejusav.pdf
    • http://sacrophonia.com/uploads/1/3/0/3/130313582/da47993e8e3.pdf
    • http://abrasax.info/uploads/1/3/0/5/130551615/130551615.html#report+on+a+road+accident+you+witnes

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016cf.bin
fb3c639a542826a6262a77148807f544cc54e1cdd999e3b798a268c36b66e773		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16CF 7564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.