Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8244865823c27af…

MALICIOUS

PDF

39.3 KB Authoring application: PDF Studio
MD5: db60006e78ba137eee16073ef709e4ac SHA-1: abd659d555555674a14b562080000aedd3cc10f5 SHA-256: f8244865823c27af0bf48b3e3c9f050b4d7699d21ed294ed8700235ca240767f
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by multiple heuristics, including a critical alert for a large number of external links, indicating a link farm. The ML classifier also assigned a high probability of maliciousness. ClamAV identified the file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', suggesting a phishing or traffic redirection scheme. The embedded URLs are likely used to distribute further malicious content or lead users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://emilysapp.com/uploads/1/3/0/2/130272372/b56e30639bc54c7.pdf
    • http://74-123-77-175.mgwnet.com/uploads/1/3/0/7/130740163/d5c4ad82e4c.pdf
    • http://liverocks.net/uploads/1/3/0/7/130739810/4603611.pdf
    • http://queenalexandra78ave.com/uploads/1/3/0/7/130775969/vomuvuwoz_kunalomopo.pdf
    • http://gogocake.com/uploads/1/3/0/4/130488395/4306530.pdf
    • http://abcdts.store/uploads/1/3/0/5/130543052/761781.pdf
    • http://selfsufficientteen.com/uploads/1/3/0/7/130775211/gumuri.pdf
    • http://networkmarketingmalaysia.com/uploads/1/3/0/7/130776032/gevuzolowupug.pdf
    • http://preludemusic.com.au/uploads/1/3/0/4/130490421/757b9789707a03.pdf
    • http://abovetumblerridge.ca/uploads/1/3/0/6/130621413/0f8d5.pdf
    • http://bodhibros.com/uploads/1/3/0/6/130639705/1dfbf6d44.pdf
    • http://insituexperiences.com/uploads/1/3/0/5/130550790/c3f8572.pdf
    • http://idobricks.com/uploads/1/3/0/4/130436258/monuxefe-dutami.pdf
    • http://bangkokrepublik.co/uploads/1/3/0/4/130476045/maxepomugunud.pdf
    • http://siberianpurrbabies.com/uploads/1/3/0/7/130775023/8483531.pdf
    • http://encompasscre.com/uploads/1/3/0/4/130483757/9674769.pdf
    • http://jazzislife.net/uploads/1/3/0/6/130604416/0a4b0.pdf
    • http://laserlily.com/uploads/1/3/0/5/130590138/vubopaj-bifejumifamebel.pdf
    • http://mmjplantation.org/uploads/1/3/0/5/130541424/mifavasukiveti_nobexe_ligejijira_nozubafe.pdf
    • http://buy-cbd.shop/uploads/1/3/0/3/130379294/95cfd1.pdf
    • http://cadescovejunkies.com/uploads/1/3/0/7/130775088/fubiwu-suwud-garem-mimibafuz.pdf
    • http://www.fillmorefamilymedicalgroup.org/uploads/1/3/0/6/130603764/revukawes.pdf
    • http://sellingonline.today/uploads/1/3/0/4/130436441/1461304.pdf
    • http://whataboutsecondbreakfast.com/uploads/1/3/0/4/130476516/9449874.pdf
    • http://oddlyspecificshirts.com/uploads/1/3/0/5/130543985/xinupaluwomexome.pdf
    • http://74-123-77-90.mgwnet.com/uploads/1/3/0/5/130542780/130542780.html#despacito+piano+sheet+music+for+beginners
    • http://bodhibros.com/u

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000344c.bin
9a2631aed90e12d5446f38ff5368fa6dfbd65b194d12a3ae4380177fcfc47ecd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x344C 8996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.