Malicious PDF — malware analysis report

Static analysis result for SHA-256 ebf4cd070ed09430…

MALICIOUS

PDF

34.9 KB Authoring application: pstoedit
MD5: d11f80726e5e212668a8baaace21449c SHA-1: 41086ede8156cb3aafb9487866ba3130439e5a25 SHA-256: ebf4cd070ed09430576c48c4402fcc7fbfb55e6d2160487644bcc14253d930d7
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall, indicating a phishing or traffic redirection scheme. The document body, though heavily corrupted, contains the phrase 'Knee cracking when bending after surgery', suggesting a lure to a health-related topic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://zoj.avtosvet24.ru/uploads/2020/01/29/sokikutebesasokemob.pdf
    • http://most-wanted-ent.com/uploads/1/3/0/6/130605248/kenexow.pdf
    • http://ellipseatlantic.com/uploads/1/3/0/7/130740391/pexoviluzidaxogub.pdf
    • https://sefejibu.weebly.com/uploads/1/3/0/3/130313271/wuvivididusi_robasonadej_bokese.pdf
    • http://techb.org/uploads/1/3/0/3/130379503/fadf5bd.pdf
    • http://mymmtx.com/uploads/1/3/0/4/130435891/xuweme.pdf
    • http://my-safety-box.com/uploads/1/3/0/4/130488530/wapujiloluxebo.pdf
    • http://mznaturallypatriciallc.com/uploads/1/3/0/5/130550993/0a70df.pdf
    • http://annachojnacka.nl/uploads/1/3/0/5/130588762/volag_debopelimuta_lopesevepoten.pdf
    • http://tcsonline.net/uploads/1/3/0/5/130589099/130589099.html#knee+cracking+when+bending+after+surgery

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011d2.bin
e096e9106c8a52f09cdfde6195d4bfe4585219773e22619077dbde1fedd2bd39		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D2 7264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.