Malicious PDF — malware analysis report

Static analysis result for SHA-256 17fdec8d4aa4f615…

MALICIOUS

PDF

38.7 KB Authoring application: LibreOffice
MD5: d6b13192b28102ace26888e89e98281a SHA-1: ac2677d0ae52da11be8de77c1d7f89979cafb943 SHA-256: 17fdec8d4aa4f615a72eb259dc9879fe1dd68e30726fd7b9920bbec988f93d1e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files across various domains, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, consistent with a phishing or content distribution scheme. No scripts were extracted, but the sheer volume of external links suggests a coordinated effort to drive traffic or deliver payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://peerlesselegance.shop/uploads/1/3/0/7/130739706/3790316.pdf
    • http://djdbaker.com/uploads/1/3/0/5/130590462/36cfe21a1577272.pdf
    • http://pastmaster.org/uploads/1/3/0/7/130776260/f0f6e99b4.pdf
    • http://neosal.com/uploads/1/3/0/6/130639393/7021162.pdf
    • http://nelslehtinen.com/uploads/1/3/0/5/130550827/9211fc9b.pdf
    • http://sayn-wittgenstein-piraccini.com/uploads/1/3/0/4/130477455/9976208.pdf
    • http://vendeziproperties.com/uploads/1/3/0/8/130813705/b0097cd9de.pdf
    • http://ourchildrensfund.com/uploads/1/3/0/6/130604248/lurezuxakugo.pdf
    • http://airyfitness.com/uploads/1/3/0/5/130590305/nafum.pdf
    • http://milkers-gloves.com/uploads/1/3/0/2/130288811/4903959.pdf
    • http://darklabs.co/uploads/1/3/0/7/130775195/nudurafotufaxep.pdf
    • http://castervaria.org/uploads/1/3/0/3/130379160/4142241.pdf
    • http://mvcatching.com/uploads/1/3/0/5/130590431/5798550.pdf
    • http://betterwebmail.com/uploads/1/3/0/7/130775741/8036f7af.pdf
    • http://nicollaslittleshop.com/uploads/1/3/0/3/130313093/4bf83b423.pdf
    • http://mountainmotoadventures.com/uploads/1/3/0/6/130604238/2184200.pdf
    • http://amychurmt.com/uploads/1/3/0/2/130272504/zebit-safasopetimowi-gafabiman.pdf
    • http://chubbycheetah.com/uploads/1/3/0/7/130776425/e89d8cbb.pdf
    • http://milkallergy.net/uploads/1/3/0/5/130546606/207a0b6e.pdf
    • http://nukastudio.com/uploads/1/3/0/2/130270798/bb45b.pdf
    • http://damiandineen.com/uploads/1/3/0/5/130539260/e7aeb20883e8b44.pdf
    • http://called2mission.com/uploads/1/3/0/3/130313619/4228081.pdf
    • http://zambiasafarihunting.com/uploads/1/3/0/3/130379757/130379757.html#basketball+strength+and+conditioning+training

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000365b.bin
73afae0f60f2f27a2797f190ab5a409296df101dbbdfc3489b4af24e2a3f422d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x365B 7880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.