Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a9b1215a16df3c7…

MALICIOUS

PDF

41.1 KB Authoring application: QPDF
MD5: f24f6cfeb60be73a8f664ec564380afa SHA-1: b84d1ca998d5869f2454133dde90b71f0de97423 SHA-256: 3a9b1215a16df3c7645206602279f302078875af1e5febddde8a57a6128f7fa2
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

This PDF file was flagged by multiple detection engines, including ClamAV and an ML classifier, indicating malicious intent. The primary heuristic identified a large number of external PDF links, suggesting a link farm or redirection scheme. The document body contains garbled text mixed with legitimate-looking content about Netflix, likely a lure to disguise the malicious links. No scripts were extracted, but the sheer volume of embedded URLs points to a phishing or SEO manipulation attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ramonmaciamusica.com/uploads/1/3/0/6/130639729/deliwit-duxeg-masevubamojuwuj-nenixijatepam.pdf
    • http://cyclebavaria.com/uploads/1/3/0/2/130287527/xowivejipub.pdf
    • http://digiproduct.org/uploads/2020/01/27/norakesovod.pdf
    • http://getkmaccontent.com/uploads/1/3/0/4/130483871/9198258.pdf
    • http://guided-wellness.com/uploads/1/3/0/4/130483086/6324611.pdf
    • http://greenroomtheatercompany.org/uploads/1/3/0/5/130550981/kokebodagavomadebot.pdf
    • http://listen2alexza.com/uploads/1/3/0/6/130621800/basolirujajujunu.pdf
    • http://artsbasedtherapy.org/uploads/1/3/0/3/130323319/befanokigi-pavazu-kosagopatepise.pdf
    • http://charlottepantherstrack.coach/uploads/1/3/0/3/130323552/7958245.pdf
    • http://wallepikkers.nl/uploads/1/3/0/5/130539935/f18919bdc.pdf
    • http://dazafaru.maska.org/uploads/2020/01/28/xuzop.pdf
    • http://keykidoll.com/uploads/1/3/0/3/130323219/764529.pdf
    • http://sgmurphy.com/uploads/1/3/0/2/130270864/difevel-demijikajinem-maxetoweluxikof-dufajer.pdf
    • http://geletuba.in-op.fun/uploads/2020/01/28/0039eea5.pdf
    • http://kylaconner.com/uploads/1/3/0/3/130313588/130313588.html#netflix+auf+computer+en

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013fc.bin
44ef74f400fba9005b921ab614d9ba1b1774d391958b8b4713ceadee39f251a4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13FC 8432 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.