Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec149b7e155becfb…

MALICIOUS

PDF

31.4 KB Authoring application: PDF Studio
MD5: eec84c4b660e7873411b49b22c97878f SHA-1: 5f19c581c23387e535596abb23e3981d743f0013 SHA-256: ec149b7e155becfbab1fdad583dcf506b3e78c80856653d5cd5bcf3b17d53c90
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical finding for a link farm and ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The embedded document body and PDF facts reveal a large number of external URLs, many of which are likely part of a phishing or redirection scheme. The primary intent appears to be directing users to potentially malicious content hosted on these external domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://miamiflpressurewashing.com/uploads/1/3/0/3/130379151/vozorex-xubamemu-tilebi-votaroxa.pdf
    • http://josiebryant.com/uploads/1/3/0/2/130292173/8bf094.pdf
    • http://trophypointcontracting.com/uploads/1/3/0/4/130483670/damijovematikejofamo.pdf
    • http://ktrpo.com/uploads/1/3/0/2/130291592/dadivuwezob.pdf
    • http://adventureswithrocks.com/uploads/1/3/0/4/130488067/dutijajuzevu.pdf
    • http://texipofoj.manvs.ru/uploads/2020/01/29/resawoluzo.pdf
    • http://efwpartners.com/uploads/1/3/0/4/130476024/ce130c.pdf
    • http://mvcheerpoms.org/uploads/1/3/0/7/130739139/xususijonobo.pdf
    • http://newmillerdam.org/uploads/1/3/0/6/130640047/964469.pdf
    • http://newearthwarrior.org/uploads/1/3/0/5/130551057/a363074186e4e6.pdf
    • https://nizikivinagunel.weebly.com/uploads/1/3/0/3/130379291/8226193.pdf
    • http://nakkurakkansweden.weebly.com/uploads/1/3/0/2/130270993/32de5.pdf
    • http://woodlandstuition.com/uploads/1/3/0/5/130538817/130538817.html#american+sports+channels+tv+guide

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012c2.bin
e9a1bf31644ddf4bee87803a5078b6c82386f21d83fc0ee9aac0a993760405de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12C2 7428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.