Malicious PDF — malware analysis report

Static analysis result for SHA-256 3166567ee39cfe0b…

MALICIOUS

PDF

55.1 KB Authoring application: Soda PDF
MD5: 089cd7d2d0b2e90b2f485e7fc2b0098f SHA-1: 1f3f60e701a71a6bd3bb67ceeacb9386989f7aa4 SHA-256: 3166567ee39cfe0bee5239aa903608e82081e609e2693944874e72ff031cc58e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF files across various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, aligning with the PDF_SEO_LINK_FARM heuristic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stagelife918.com/uploads/1/3/0/6/130621216/9172567.pdf
    • http://newplumtreeheights.com/uploads/1/3/0/6/130621840/7226700.pdf
    • http://noblesrealtygrp.com/uploads/1/3/0/5/130539837/rexakujafanatobadus.pdf
    • http://americanational.us/uploads/1/3/0/4/130483978/xovigagarar.pdf
    • http://cwcphysio.com/uploads/1/3/0/5/130551001/pazos.pdf
    • http://mail3.hauntedhousetour.com/uploads/1/3/0/5/130539660/3967064.pdf
    • http://nuecescanyonlodge.com/uploads/1/3/0/7/130740191/9233233.pdf
    • http://settenove.info/uploads/1/3/0/6/130639700/171e8a24e.pdf
    • http://hostmaster.fidgetandbob.co.uk/uploads/1/3/0/8/130813332/3895065.pdf
    • http://mrsrosatosclass.com/uploads/1/3/0/7/130740429/kevakupemuje.pdf
    • http://ketoboxie.com/uploads/1/3/0/8/130814623/9359739.pdf
    • http://www.blueprinttocash.stefanaarnio.com/uploads/1/3/0/7/130739938/3145060.pdf
    • http://genomikocoffee.com/uploads/1/3/0/7/130775892/rovoxutomilov.pdf
    • http://chasm-book.com/uploads/1/3/0/2/130289441/lomamapetizefix.pdf
    • http://www.mazaalaifriends.com/uploads/1/3/0/8/130874409/4199352.pdf
    • http://crisme.com/uploads/1/3/0/6/130620460/tovolojanasiradubag.pdf
    • http://deerwoodgroup.com/uploads/1/3/0/6/130604542/2443647.pdf
    • http://thefemaleweddingphotographers.co.uk/uploads/1/3/0/5/130588678/dekogum.pdf
    • http://headblocks.org/uploads/1/3/0/6/130604521/130604521.html#comment+draguer+une+fille+par+sms+pour+la+premi%C3%A8re+fois

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000131b.bin
75e3802a6b66abf1e5a85c536243bf55c276f66b1bee5c4455e5106099994156		 pdf-font-stream PDF embedded font (sfnt) at offset 0x131B 10420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.