Malicious PDF — malware analysis report

Static analysis result for SHA-256 158306a685817183…

MALICIOUS

PDF

34.0 KB Authoring application: PDFBox
MD5: f9903f944f4730467e5ec78c7f881def SHA-1: e5f7f8e0e14e67e84bd3f2d7a35821b3b2f6db7b SHA-256: 158306a685817183367f11f07aad49166b77a32dd2e4b4ffc35d8a78722e516a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0. The presence of 24 embedded URLs, many with numeric slugs, strongly suggests a link farm designed to redirect users to malicious content. No scripts were extracted, but the sheer volume of external links indicates a likely phishing or malware distribution attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://alanruuska.com/uploads/1/3/0/7/130740178/f198150.pdf
    • http://propertymanagerfinder.com/uploads/1/3/0/5/130540746/pubelo.pdf
    • http://bellasafety.com/uploads/1/3/0/6/130620431/47c709b2cf402.pdf
    • http://mail.amaniabraham.com/uploads/1/3/0/9/130969731/wonegolune-mogapimegopidi-pogunapirar-vovaradoj.pdf
    • http://merosound.com/uploads/1/3/0/6/130604702/jotesuver.pdf
    • http://rowancannell.com/uploads/1/3/0/4/130488626/241b6c10613.pdf
    • http://thehappycouple.org/uploads/1/3/0/3/130312920/fidofuxaruvaveb-maxefitebakajob-rinetonal-dalusifix.pdf
    • http://pinnaclesolarelectric.com/uploads/1/3/0/6/130620437/920aec4.pdf
    • http://rykowskiandassociates.net/uploads/1/3/0/7/130739793/44ebe7f088e93a3.pdf
    • http://tasteparty.jpjsweets.com/uploads/1/3/0/9/130969529/gurewolalatiju.pdf
    • http://carltonhouse.care/uploads/1/3/0/7/130775181/7203034.pdf
    • http://exclusiveplumbingleadz.com/uploads/1/3/0/6/130605278/5729137.pdf
    • http://coloradoexecutiveclub.com/uploads/1/3/0/7/130739664/tupenibazoku.pdf
    • http://www.roselynshoplist.com/uploads/1/3/0/5/130539097/7efc868c162.pdf
    • http://www.reignunit.com/uploads/1/3/0/4/130436173/zafeso.pdf
    • http://www.gheldercare.com/uploads/1/3/0/9/130969628/raziwufuxubabul.pdf
    • http://kohsamuirentavilla.com/uploads/1/3/0/5/130543665/3513380.pdf
    • http://aliendeduction.com/uploads/1/3/0/8/130813054/d00bb40f91a5.pdf
    • http://www.assetlocate.com.au/uploads/1/3/0/2/130271232/8461998.pdf
    • http://gigivangos.com/uploads/1/3/0/7/130739280/sawagep.pdf
    • http://myprovidenceconstruction.com/uploads/1/3/0/6/130621307/xevexokid.pdf
    • http://topofthemoutaingraphics.com/uploads/1/3/0/7/130775554/polaze-gamemujiku-kamok.pdf
    • http://www.auzmoproducts.com/uploads/1/3/0/5/130542866/kigetes_wadikez.pdf
    • http://europeangreatdane.com/uploads/1/3/0/5/130550887/guseselajotovatu.pdf
    • http://kkft3.bpmtc.com/uploads/1/3/0/4/130476185/130476185.html#magoosh+gre+vocabulary+ebook+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002165.bin
2c993e5f66fd40efb18d8941d6dcc93cceb49751a9e75d3325a2a0781a6d0d2c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2165 7776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.