Malicious PDF — malware analysis report

Static analysis result for SHA-256 f3625a56c366c3c9…

MALICIOUS

PDF

42.2 KB Authoring application: Poppler-utils
MD5: fdf66ebb606aa2165e49e0c4cd69ae98 SHA-1: 3b00b4e69cb189b6bd7fb7fc7fc5ba926d28d561 SHA-256: f3625a56c366c3c9f3a15a2086c6748a12e66063d35c180a854c4cae0c796861
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0 and exhibits a large number of embedded external links, indicating a potential phishing or SEO spam campaign. The document body contains garbled text, suggesting it is not intended for direct user interaction but rather as a container for the malicious links. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://famousfoam.maryhigginswebdesign.com/uploads/1/3/0/5/130550981/piwexaxap.pdf
    • http://karizmalingerie.net/uploads/1/3/0/9/130969270/3482069.pdf
    • http://amandaferg.com/uploads/1/3/0/5/130588605/folenu.pdf
    • http://bloomchildrensboutique.com/uploads/1/3/0/4/130483480/zofowoli_jubekit_jogetipazo.pdf
    • http://newyoujewelryshop.com/uploads/1/3/0/7/130740084/4800483.pdf
    • http://pocketbricks.com/uploads/1/3/0/2/130289629/mogaf-wojetapu.pdf
    • http://thepaleocaveman.com/uploads/1/3/0/2/130291769/jesopek.pdf
    • http://3mtruedef.com/uploads/1/3/0/5/130551684/gukiwepekurepag.pdf
    • http://absolutionnyc.com/uploads/1/3/0/2/130274338/juvizugomirawin_baxatu.pdf
    • http://autodiscover.plastics-media.com/uploads/1/3/0/3/130323522/1b3abfaa9.pdf
    • http://usedhorsesaddles.com/uploads/1/3/0/3/130323968/temexiz.pdf
    • http://coletteliebenberg.com/uploads/1/3/0/8/130874136/6823971.pdf
    • http://silvermongoose.com/uploads/1/3/0/8/130813301/nofonujosururajapisa.pdf
    • http://writewithmatthews.com/uploads/1/3/0/4/130490488/7663161.pdf
    • http://childrensliteratureassembly.com/uploads/1/3/0/3/130379070/8782877.pdf
    • http://blacklistacademy.com/uploads/1/3/0/3/130313013/xanuzufop_jidir_pajoso.pdf
    • http://vanessamallen.com/uploads/1/3/0/5/130547340/3452119.pdf
    • http://mta-sts.mx.jerseydentalstudio.com/uploads/1/3/0/6/130604973/6297682.pdf
    • http://ilusive.com/uploads/1/3/0/2/130274166/jokelelasupabi_vufazotiju.pdf
    • http://cinderscapesorl.com/uploads/1/3/0/6/130640071/3434816.pdf
    • http://pensacoin.com/uploads/1/3/0/4/130435597/jejavovusu.pdf
    • http://bellatilerepair.com/uploads/1/3/0/7/130776162/mimezefikuvop-vutamidobuloj-jasutulumekofu.pdf
    • http://cpanel.storgebhs.com/uploads/1/3/0/4/130475932/130475932.html#aetna+medicare+prior+authorization+medication+form
    • http://amandaferg.com/uplo

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000041ea.bin
6336caa757b0e546d5ff6b1cbcf51a025aa477d74333a11e8da2c3ea2f9817a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x41EA 8440 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.