Malicious PDF — malware analysis report

Static analysis result for SHA-256 e57f2a4937d57ba7…

MALICIOUS

PDF

35.8 KB Authoring application: QPDF
MD5: a00d4485dc4117b1a3ed9c8ad1cbda6c SHA-1: 66ee268f46c37592f989da85d9574d172e091bd7 SHA-256: e57f2a4937d57ba71394b8fe6462a7c4d3b6d801d11ca29f7ef681a7e3fb437c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical alert for a link farm and ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The ML classifier also assigned a high probability of maliciousness. The document body contains numerous external URLs, indicating a likely phishing or malware distribution attempt by redirecting users to potentially compromised sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tidewaterathletics.com/uploads/1/3/0/6/130605493/zesusifo-jedimizano-buwikifigi-kewemab.pdf
    • http://tobler-design.ch/uploads/1/3/0/6/130620833/9b7b0.pdf
    • http://pocket-ultrasound.com/uploads/1/3/0/5/130551086/tifojoje_rorofiwopolijur_joxovubur_somuparubobabux.pdf
    • http://jacsmacdl.org/uploads/1/3/0/2/130287371/e15eed925bce.pdf
    • http://danielstorage.com/uploads/1/3/0/7/130775506/pinekikiwapeki.pdf
    • http://birminghamconcreteremoval.com/uploads/1/3/0/7/130739212/2515775.pdf
    • http://mysticgardentw.com/uploads/1/3/0/2/130288381/labarupesiz-vufevejagariboj.pdf
    • http://222-big-bon.site/uploads/1/3/0/7/130738890/1660654.pdf
    • http://kylejustin.com/uploads/1/3/0/7/130738603/343e2328d728d.pdf
    • http://micahrichman.com/uploads/1/3/0/6/130621640/lunoxufuzidupor.pdf
    • http://merryhillcbd.com/uploads/1/3/0/6/130604286/40ea954.pdf
    • http://motobabegear.com/uploads/1/3/0/3/130313170/6f53d73d012d90.pdf
    • http://everyliving.com/uploads/1/3/0/3/130379844/fac82fda50.pdf
    • http://abby-yoga-massage.com/uploads/1/3/0/2/130272573/e7433e5e4f61a71.pdf
    • http://aucklandpolo.com/uploads/1/3/0/8/130814106/7469774.pdf
    • http://myoutdoorvisions.com/uploads/1/3/0/6/130605015/9968724.pdf
    • http://blueprinttocash.stefanaarnio.com/uploads/1/3/0/7/130738933/130738933.html#circuit+of+precision+full+wave+rectifier

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f9e.bin
96af46d22936c906a98818842e5a2a5077a55b3672ad3529009bd0bfce5d90f7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F9E 8060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.