Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe0479f1db8ae72e…

MALICIOUS

PDF

41.6 KB Authoring application: Soda PDF
MD5: e6c4962e6232a1ffed3cd22f205c4000 SHA-1: db2305df551f572ecf48d1d566a33c9a4a8de228 SHA-256: fe0479f1db8ae72ef71849dfffb73e0898517ee507a40c2bd4c43d76d9cbc0ac
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files, indicating a link farm. This is strongly suggestive of SEO manipulation or a distribution mechanism for further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent. No scripts were extracted from this sample, limiting the analysis of direct execution capabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bearsvbabiesgame.net/uploads/1/3/0/5/130539129/bugivi.pdf
    • http://www.thefitferret.com/uploads/1/3/0/5/130550693/noziripow.pdf
    • http://myjamesandrews.com/uploads/1/3/0/6/130604644/vonobiraramotu.pdf
    • http://yiyistory.com/uploads/1/3/0/6/130621663/wusuretikike.pdf
    • http://airporthistory.net/uploads/1/3/0/7/130740180/davokiw_foxujekur_paripotulibujo.pdf
    • http://nyclunarnewyear.org/uploads/1/3/0/6/130603930/regilad-pawujaworofa-woxik-dasizozizokubil.pdf
    • http://mangosutra.net/uploads/1/3/0/3/130313567/0fa25b440634.pdf
    • http://ronemilecomedy.com/uploads/1/3/0/4/130488332/nijesiwuzed.pdf
    • http://nutrients.supply/uploads/1/3/0/7/130739564/xuxekub_newupakal_konelarif.pdf
    • http://delorenzohaircare.com/uploads/1/3/0/6/130621352/1011220.pdf
    • http://thetruthaboutarthurspector.org/uploads/1/3/0/6/130604632/33f09a90491d.pdf
    • http://iferze.net/uploads/1/3/0/5/130550711/2916783.pdf
    • http://katharicleaningservicesllc.com/uploads/1/3/0/7/130775551/sizanigenimukenek.pdf
    • http://northcountryhomeinspection.com/uploads/1/3/0/8/130813510/a2fdae59e82023e.pdf
    • http://74-123-79-160.mgwnet.com/uploads/1/3/0/4/130488975/130488975.html#how+to+activate+cheat+codes+in+gta+vice+city+pc
    • http://nutrients.supply/uploads

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030ae.bin
f31c439e28d0137206b91a151f21343900f846ed9ff070250fbe82eb1cc7da1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30AE 16204 bytes
font_01_sfnt_off00004897.bin
99f1dcc8914141f76a44f24fc3d05415961b55710ac353bbfde04a25ed1e44c8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4897 7972 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.