Malicious PDF — malware analysis report

Static analysis result for SHA-256 47810016ca9f1afd…

MALICIOUS

PDF

36.4 KB Authoring application: Pdftk
MD5: c2f5eb9571f382757edd28edc964b864 SHA-1: c551cd6bc269e44a0773bd8530eb086a8faef2c3 SHA-256: 47810016ca9f1afd9335d50f232812a554bb7292e3c2ba2e4f3fcb95edae158b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1204.001 User Execution: Malicious Link T1566.002 Phishing: Spearphishing Link

The sample is a small PDF containing a high volume of external links (31 total), which is characteristic of an SEO link farm. ClamAV identifies this as Pdf.Phishing.TtraffRobotInstall, and the ML classifier shows a very high malicious score. The document body contains largely obfuscated or binary data, suggesting the content is designed for search engine indexing rather than human readability.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lolrednecks.net/uploads/1/3/0/5/130588159/pudisademusewed.pdf
    • http://custompinsforyou.com/uploads/1/3/0/5/130550936/9747158.pdf
    • http://sejasurpreendente.com/uploads/1/3/0/4/130435826/3242642.pdf
    • http://jjtautomotorrepair.com/uploads/1/3/0/2/130272474/159564.pdf
    • http://rohrsenfitness.com/uploads/1/3/0/4/130488417/nogesuvomavit.pdf
    • http://marketinginalbania.net/uploads/1/3/0/6/130639701/9927871.pdf
    • http://neoshirtco.com/uploads/1/3/0/5/130544070/5594819.pdf
    • http://onestepborders.com/uploads/1/3/0/5/130589090/68ccce3d1e966e.pdf
    • http://www.firstdesign.org/uploads/1/3/0/4/130476740/2a37814fa.pdf
    • http://cbdstraight.com/uploads/1/3/0/4/130488741/pojaf_gisakizepewo.pdf
    • http://jr.wardelkins.com/uploads/1/3/0/5/130541944/megubojuvumise.pdf
    • http://voreckapp.com/uploads/1/3/0/7/130740055/429496.pdf
    • http://anderson-hammond.com/uploads/1/3/0/7/130738499/resubo-pupasudukopanoj-xuxarove-majar.pdf
    • http://triumphantlawnandlandscapeservices.com/uploads/1/3/0/6/130639140/2625852.pdf
    • http://theshiatsuroom.co.uk/uploads/1/3/0/5/130546923/8010371.pdf
    • http://charlieleegeorge.com/uploads/1/3/0/6/130639121/gowisozafe-varilajozupu.pdf
    • http://34gda.brdge.org/uploads/1/3/0/5/130588596/130588596.html#stomach+ulcer+helicobacter+pylori
    • http://triumphantlawna

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003276.bin
85f6576051d6df4351287a9e3f3f87e4745a026d4fb6885b3ab865330cab3d54		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3276 7892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.