Malicious PDF — malware analysis report

Static analysis result for SHA-256 f970372f43fd3ce9…

MALICIOUS

PDF

38.9 KB Authoring application: PDFedit
MD5: 382b355dc0ad649eecf854ada9da01cb SHA-1: 52abdf912701c6da36f453710f824b31e9bef00c SHA-256: f970372f43fd3ce9cc7f575fa0b425a1edcb95e5a1458607bebf0f10287b2c12
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute malicious content. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a machine learning classifier also flagged it as malicious. The document body contains garbled text, suggesting it is not intended for human consumption but rather as a container for the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://declanvoss.com/uploads/1/3/0/3/130324203/8826080.pdf
    • http://wtneonline.com/uploads/1/3/0/4/130476878/4821655.pdf
    • http://lifetunesonline.net/uploads/1/3/0/2/130287976/tadoviv_libar_sosefebetami_rowibigufami.pdf
    • http://rosiemillicentkeating.com/uploads/1/3/0/6/130621686/3877450.pdf
    • http://springcreekranchclublambs.com/uploads/1/3/0/6/130621215/8653823.pdf
    • http://micremacion.com/uploads/1/3/0/5/130546209/277923.pdf
    • http://memoriesinsoap.com/uploads/1/3/0/2/130272606/juribirobapamuw.pdf
    • http://whenapp.com/uploads/1/3/0/6/130621401/zubobubo-rovuriliter-vepamupowigozi.pdf
    • http://divinefaithtarot.com/uploads/1/3/0/4/130436288/kamumujekil.pdf
    • http://azmendinglives.com/uploads/1/3/0/6/130621496/luxama.pdf
    • http://geneticdetection.com/uploads/1/3/0/5/130542902/ac896.pdf
    • http://ardentbliss.com/uploads/1/3/0/6/130604532/665657.pdf
    • http://nataliashand.com/uploads/1/3/0/6/130640181/miwoputada.pdf
    • http://bhpmedicalconsultants.com/uploads/1/3/0/4/130476492/vojajirin.pdf
    • http://www.cypresspointerehabhc.com/uploads/1/3/0/5/130544754/c80949f4.pdf
    • http://thegreenstyleblog.com/uploads/1/3/0/5/130588763/gifonalemivesujo.pdf
    • http://www.crawford-wedding.rominastiebenphotography.com/uploads/1/3/0/6/130639980/130639980.html#heart+chakra+kundalini+kriya
    • http://declanvoss.com/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003b76.bin
f0606ea0c59779dd291dc752772a5df0f984b14c332e1e333de34cb9bbdbf320		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B76 8332 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.