Malicious PDF — malware analysis report

Static analysis result for SHA-256 169cad693de5702f…

MALICIOUS

PDF

39.9 KB Authoring application: pdf-parser
MD5: ae5c98f2ff205037dce13e59491d41e8 SHA-1: 8b192e9bd5636fd32938590f26a075252e7c94e8 SHA-256: 169cad693de5702faf7b167a5f076b67fcf07d39fd3a015346e4fc7ffde5081b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files across various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tacticalvalkyrie.com/uploads/1/3/0/5/130539114/gelinulijuzex.pdf
    • http://acmbuenosaires.org/uploads/1/3/0/6/130620950/24503c89b56.pdf
    • http://myescondidosoccer.com/uploads/1/3/0/6/130639061/208300.pdf
    • http://thinkglobaly.com/uploads/1/3/0/4/130476751/xesudidupa_bufigibexujawo_tuwug.pdf
    • http://marytherapeuticmassage.com/uploads/1/3/0/5/130588607/zarevuxidarajugufa.pdf
    • http://nextgentheatreco.com/uploads/1/3/0/6/130604855/videl_zudumewelukopen_sekivowebox.pdf
    • http://bealegacybuilder.com/uploads/1/3/0/5/130551310/0c7ab9.pdf
    • http://moshathestylist.com/uploads/1/3/0/6/130604519/midodusiwizopoj.pdf
    • http://msdanielledobeleit.com/uploads/1/3/0/2/130287242/a423ed881379.pdf
    • http://goldsmitsydnor.com/uploads/1/3/0/6/130621695/wezusuwuzegewofap.pdf
    • http://tatismoving.ca/uploads/1/3/0/5/130551456/6645188.pdf
    • http://lewox.skladovskij.ru/uploads/2020/01/29/zazugizupuge.pdf
    • http://cfthomas.com/uploads/1/3/0/4/130478470/130478470.html#lesson+20+solving+absolute+value+inequalities

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013e5.bin
297f4ac2984bacb057b428ad4803f92b9b7cca84d40adcdc60f7ec46480244e4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13E5 8756 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.