Malicious PDF — malware analysis report

Static analysis result for SHA-256 f154c9187bbedd3d…

MALICIOUS

PDF

40.4 KB Authoring application: pdf-parser
MD5: 20246843123aee6bbb970d67902d4a65 SHA-1: a5228a16ae178b049def6af30d36e7e007866cd3 SHA-256: f154c9187bbedd3d74bad016045f47b5edd355fb993b70c15f69c0f6ced1c00e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique commonly used for SEO poisoning or phishing lures. The heuristic 'PDF_SEO_LINK_FARM' and ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly indicate a malicious intent to redirect users to potentially harmful content. The document body, though partially corrupted, also contains some of these URLs, reinforcing the link farm attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nmisria.com/uploads/1/3/0/3/130313224/c2dcf.pdf
    • http://rockymountainhomeinvestors.com/uploads/1/3/0/4/130483821/79129f8472396f.pdf
    • http://makercenterusa.com/uploads/1/3/0/4/130436171/wimutegivirarefev.pdf
    • http://fynnad.store/uploads/1/3/0/6/130621500/a06bf.pdf
    • http://texyak.club/uploads/2020/01/29/vifajawekepeve.pdf
    • http://bigbrightearth.com/uploads/1/3/0/6/130620871/65c390d3.pdf
    • http://montrealbachelorweekend.com/uploads/1/3/0/4/130488829/nojarakebelemoluba.pdf
    • http://paschal77.com/uploads/1/3/0/6/130605421/e4fe108d2.pdf
    • http://mocopridefestival.org/uploads/1/3/0/5/130542924/desekodizoseduzibo.pdf
    • http://hollyknoxrhame.com/uploads/1/3/0/6/130639409/72e85.pdf
    • http://coinsofthetrade.com/uploads/1/3/0/5/130551671/tizetisisineg.pdf
    • http://niyati-plongee.com/uploads/1/3/0/2/130289359/zowulupuzigolof.pdf
    • http://beingself-centered.com/uploads/1/3/0/4/130436033/130436033.html#deformed+babies+at+birth

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000132a.bin
d3f97a513811ee9a8645d2258284a90d3584d7947a2443667765de9ad14404d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x132A 8988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.