PDF malware analysis — malicious · 1f8724119934e2f0

MALICIOUS

PDF

40.4 KB Authoring application: PDF Studio

MD5: 9b33f1e9bc17c20c8eb0d3551a5557ad SHA-1: 065f3a32a9928e19e9354d3d9875dedcfdd2930c SHA-256: 1f8724119934e2f0eb1a630e87523f70454fc366fa995175f7721fb86ac62d39

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files hosted across various domains, indicating a link farm or redirection scheme. This is strongly suggestive of a phishing or malware distribution campaign. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this assessment. No scripts were extracted, limiting the analysis of direct malicious actions within the document itself.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://surtimportaciones.com/uploads/1/3/0/6/130621278/bezomudenawom.pdf
- http://msaecr19.com/uploads/1/3/0/5/130544468/a162224a.pdf
- http://vidtoys.com/uploads/1/3/0/7/130740571/2203469.pdf
- http://indigenousmasculinities.com/uploads/1/3/0/5/130588270/jokorabikaxa_medepema_sixunaf.pdf
- http://rodgersandcoonline.com/uploads/1/3/0/2/130292013/930f38.pdf
- http://offishallifestyle.com/uploads/1/3/0/8/130813668/4863353.pdf
- http://citasonlinepasaporte.com/uploads/1/3/0/7/130776016/ludakosekiwumi.pdf
- http://bentcreeksolutions.com/uploads/1/3/0/4/130435783/likizug-jomugite-ganejub-vatutiniradam.pdf
- http://standby-travel.co.uk/uploads/1/3/0/5/130588428/6082851.pdf
- http://techtable.co/uploads/1/3/0/7/130739583/woteravuxekorid-wedesu-sitigid-negisudem.pdf
- http://amhrconsulting.com/uploads/1/3/0/5/130588980/jafaditabo_serodekapupalu_fepedesigusez_waviberuwotak.pdf
- http://floridacaregivingservices.com/uploads/1/3/0/8/130874121/f97a766093.pdf
- http://activeachievers.com/uploads/1/3/0/3/130379061/lusorejufo.pdf
- http://lucid-labview.net/uploads/1/3/0/5/130588857/57e345c5882.pdf
- http://hostmaster.emmanuelstaunton.org/uploads/1/3/0/2/130270763/1423212.pdf
- http://emailmarketing507.com/uploads/1/3/0/7/130776657/9047426.pdf
- http://pursuitofhappiness.live/uploads/1/3/0/2/130289648/xubikabuxon-zuvepokofenuba-nedujuluropote.pdf
- http://theblogfather.co.nz/uploads/1/3/0/5/130551226/30c20.pdf
- http://nodeberiacontarlo.com/uploads/1/3/0/3/130379061/vofodokasufo.pdf
- http://pineislandspices.com/uploads/1/3/0/7/130775372/9299136.pdf
- http://legacyparenting.today/uploads/1/3/0/5/130590295/redagedowub.pdf
- http://lindsayslittlecookingacademy.com/uploads/1/3/0/6/130604631/bawubesolusifitagida.pdf
- http://mcclinton.net/uploads/1/3/0/4/130489914/fisolubum-nuduva-jaxageweb.pdf
- http://namastamyoga.com/uploads/1/3/0/8/130813514/tosijatomam.pdf
- http://islamicfinancenorthamerica.com/uploads/1/3/0/5/130588437/kejafuba.pdf
- http://7m.lucky1st.com/uploads/1/3/0/6/130603835/130603835.html#acca+paper+f8+audit+and+assurance+international+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00003795.bin` `4a201cbe2865c671191a9acfe3534d43bd3f44cda3a8ec0e38c22289425c1228`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3795	8408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.