Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f3eba9f26f47092…

MALICIOUS

PDF

41.4 KB Authoring application: pdf-parser
MD5: 1e06de3912ec68d011247e39fe3e3d4b SHA-1: c6ef8ce5df15a1d02692a095de57ad99aec18647 SHA-256: 0f3eba9f26f47092c1bd9b4581a8800f10ad0b9220ec9e7ff8e2681aa42b26bb
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on various domains, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or distribute additional malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://themanlytimes.com/uploads/1/3/0/2/130287269/megej.pdf
    • http://belindawabelo.com/uploads/1/3/0/2/130272389/5e91d.pdf
    • http://players-lodge.de/uploads/1/3/0/3/130323522/savigugotosol_jujerefavisad_lirabi_gadenevunijoxad.pdf
    • http://mutualhousingny.net/uploads/1/3/0/8/130814106/zomadumexod.pdf
    • http://shesthesgent.com/uploads/1/3/0/9/130969659/nafuxaxexexudaf.pdf
    • http://808roofers.com/uploads/1/3/0/9/130969441/2b4a47ec47349b3.pdf
    • http://elizabethjin.com/uploads/1/3/0/2/130272361/gileworafe_vikuwifinejos_vuwasetufarox_peginazifi.pdf
    • http://prdistributors.net/uploads/1/3/0/5/130589168/vakulumegabawav.pdf
    • http://nwm4.club/uploads/1/3/0/6/130639664/vekolaw.pdf
    • http://tenstatecomic.com/uploads/1/3/0/2/130287506/4917cded.pdf
    • http://meresoft.net/uploads/1/3/0/5/130551671/fowubapivokular-rasinagem.pdf
    • http://ww.bgcv.org/uploads/1/3/0/5/130590323/130590323.html#pic16f877a+datasheet+espa%C3%B1ol

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000486a.bin
ab7d3d7ad1eecf8289fe8b030581077b86bce475e1c69c160c9d07f500c258c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x486A 9396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.