Malicious PDF — malware analysis report

Static analysis result for SHA-256 1447c95448265ac2…

MALICIOUS

PDF

41.3 KB Authoring application: PDF Studio
MD5: 1052feed38d40dff7a7e18d90906020f SHA-1: 9981e9388d366bfd3b953ebb9e5493c4cfb7e3d0 SHA-256: 1447c95448265ac2f5f6ac5342d7f0b9807eea1032d522e41a6ec5a107f84057
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, which strongly suggests a link farm used for distributing malicious content. The ClamAV detection and ML classifier further confirm its malicious nature, likely as a phishing or spam distribution vector. No scripts were extracted, but the embedded URLs are the primary indicators of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thedollhousellc.com/uploads/1/3/0/4/130488736/1d5515f15ff.pdf
    • http://atlanticseasaltcompany.com/uploads/1/3/0/5/130589101/93d9f2af.pdf
    • http://elevationchurchsocal.com/uploads/1/3/0/8/130873737/c9262965a3c6.pdf
    • http://marloaselin.com/uploads/1/3/0/7/130776040/1882.pdf
    • http://namanulii.com/uploads/1/3/0/4/130478314/5b5d1470.pdf
    • http://mindforyouth.org/uploads/1/3/0/4/130488696/nixulezuminuwagilim.pdf
    • http://filthyfigment.com/uploads/1/3/0/5/130589391/1c599adf7eaa9.pdf
    • http://livinghubs.com/uploads/1/3/0/4/130435757/5be04827e542e77.pdf
    • http://phaze1online.com/uploads/1/3/0/6/130639875/wiwufones.pdf
    • http://www.thecheckupapp.com/uploads/1/3/0/7/130738730/jigizugi.pdf
    • http://repast-catering.com/uploads/1/3/0/7/130739152/tifuzajerekiki_wojakixuva_mekugedo.pdf
    • http://doveyjunction.org/uploads/1/3/0/5/130543368/1224728.pdf
    • http://canecharleston.com/uploads/1/3/0/4/130488157/gotutifare.pdf
    • http://theultimatecruiser.com/uploads/1/3/0/6/130621011/petezuvow.pdf
    • http://joe-otoole-photography.com/uploads/1/3/0/6/130639646/raxirot.pdf
    • http://billionsstreet.store/uploads/1/3/0/4/130483163/79a7df5e421b.pdf
    • http://hostmaster.cofi-charity.org.uk/uploads/1/3/0/2/130270742/1335140.pdf
    • http://vermatesa.com/uploads/1/3/0/4/130476661/7312970.pdf
    • http://theapothecaryagency.org/uploads/1/3/0/8/130814329/e2b1d21135a.pdf
    • http://missinglinkbrewing.co.uk/uploads/1/3/0/4/130476709/bikijudozikobiga.pdf
    • http://hotelbliss.org/uploads/1/3/0/8/130874623/mizara.pdf
    • http://www.juicespancakelounge.com/uploads/1/3/0/4/130436050/novinoxemijavub_barimap_naredexaxomi_rafuniw.pdf
    • http://cbdcreamonline.com/uploads/1/3/0/4/130488169/9cbe884ac5ae.pdf
    • http://katiaponomareva.com/uploads/1/3/0/6/130639335/130639335.html#deductive+reasoning+questions+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003f65.bin
c90b5d20959723e0122d970f5211905e6112a0ba7bcc8279526e401066cbe82e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3F65 7980 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.