Malicious PDF — malware analysis report

Static analysis result for SHA-256 58c9fd7fc835bbbb…

MALICIOUS

PDF

34.4 KB Authoring application: PDF Studio
MD5: 2ff8740204614f966ad27c44be356889 SHA-1: eac70fff99d2f04a85ac7703bac54b519b1819ea SHA-256: 58c9fd7fc835bbbb0f6b863999c34a38239b3130a960ec0a88f38f8c24dc4116
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF document was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The critical PDF_SEO_LINK_FARM heuristic indicates the presence of numerous external links, with the first identified URL being http://e-bikerepair.com/uploads/1/3/0/6/130639393/c21dac.pdf. This suggests a phishing or SEO manipulation tactic, aiming to redirect users to potentially harmful content or improve search engine visibility for malicious sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://e-bikerepair.com/uploads/1/3/0/6/130639393/c21dac.pdf
    • http://aboutdrycleaning.com/uploads/1/3/0/2/130288338/6580643.pdf
    • http://whenjusticeisntjust.com/uploads/1/3/0/5/130544132/kekunafojufuk.pdf
    • http://www.backyardfootyposts.net/uploads/1/3/0/7/130775629/tazimunedajeva.pdf
    • http://chambers-maids-brecon.com/uploads/1/3/0/2/130272362/90f52a5.pdf
    • http://andyrein.com/uploads/1/3/0/6/130603986/5827002.pdf
    • http://myflorapops.com/uploads/1/3/0/7/130738554/geziru.pdf
    • http://betreutes-eck.com/uploads/1/3/0/5/130541103/9484885.pdf
    • http://thechinahustle.us/uploads/1/3/0/4/130488736/ed4d3a946a.pdf
    • http://mx.myclassblog.com/uploads/1/3/0/7/130775694/voporobetoposij.pdf
    • http://harveyclay.com/uploads/1/3/0/6/130604508/wogadum_pimumipisajap_nofelim.pdf
    • http://hartford-crosstrek.com/uploads/1/3/0/5/130589313/dafemu.pdf
    • http://onetenna.com/uploads/1/3/0/2/130272081/e01ac8cf14b1.pdf
    • http://mycarlrogers.com/uploads/1/3/0/7/130776561/panumibivovum.pdf
    • http://adsl-63-204-18-43.benefitplans.org/uploads/1/3/0/5/130588151/130588151.html#ucla+acceptance+letter+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d72.bin
4d695e5fd66a1e6ebe90808ee87e24713b3e1ec919de559ff9945243bece20cc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D72 7564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.