Malicious PDF — malware analysis report

Static analysis result for SHA-256 6028f74e2324b9d7…

MALICIOUS

PDF

96.0 KB Authoring application: PDF Studio
MD5: 4e99e62deced911a0a088d96e377bd02 SHA-1: 7a586bf562a9755b9a1ef9477d1d97981ff3b0a2 SHA-256: 6028f74e2324b9d78e3bd27a8848cc568ac6c2e5219792696989945160b8f336
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also indicate maliciousness, specifically flagging it as phishing-related. While no scripts were explicitly extracted, the structure suggests an attempt to redirect users to a vast network of PDF files, likely for malicious purposes such as SEO spam or distributing further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://romanacoutureshop.com/uploads/1/3/0/7/130739751/moniwalo_netezerotufos_mamifola_rijekisizupu.pdf
    • http://mrgmediamarketing.com/uploads/1/3/0/5/130540619/rimuso_piwoberex.pdf
    • http://modern-energy.co.uk/uploads/1/3/0/8/130814769/8a3a0b104.pdf
    • http://www.mapletraceneighbors.com/uploads/1/3/0/6/130620958/4761849.pdf
    • http://naveedsonikamembers.com/uploads/1/3/0/7/130740612/f6bb6f.pdf
    • http://lucidpapercuts.com/uploads/1/3/0/7/130739399/8186063.pdf
    • http://speed-gemmes.com/uploads/1/3/0/5/130589014/5773641.pdf
    • http://hoosierdaddio.com/uploads/1/3/0/2/130287799/c458baad1c3.pdf
    • http://learnonlinefast.com/uploads/1/3/0/7/130775652/df8f98f9.pdf
    • http://storehouseqc.com/uploads/1/3/0/5/130588867/9749745.pdf
    • http://www.thequeensofheart.love/uploads/1/3/0/8/130874529/d8d4f35ee95.pdf
    • http://gwbmusic.com/uploads/1/3/0/7/130740562/3c9c41634e.pdf
    • http://plants-paintings.studio/uploads/1/3/0/5/130551697/1042246.pdf
    • http://www.kccannabizconexpo.org/uploads/1/3/0/8/130814286/2babf15.pdf
    • http://rcelectrics.com/uploads/1/3/0/3/130324004/lawigefidaz_pimitoboxilekip.pdf
    • http://holypostapp.com/uploads/1/3/0/6/130604541/luzovabivaki.pdf
    • http://burningfiddleproductions.org/uploads/1/3/0/7/130739227/1811c.pdf
    • http://wangziyulekaihu.br3h.com/uploads/1/3/0/6/130604195/130604195.html#andaman+and+nicobar+honeymoon+packages+from+pune

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001462.bin
6de36714dc69f88bd5357cd8eaf776e1dc0ed51025796279716fe2909b4ad0a2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1462 8188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.