Malicious PDF — malware analysis report

Static analysis result for SHA-256 61aa70ec0a71caa4…

MALICIOUS

PDF

34.2 KB Authoring application: Smallpdf Desktop
MD5: 59067ee558db0e9013197ec9a95a72e5 SHA-1: c4382724ee1173f91a8b65b7981bc4ec8b26e8a9 SHA-256: 61aa70ec0a71caa4cae31bbfd3bc267cc65ded76c8ca98d501aba43d682b3b47
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of embedded URLs pointing to external PDF files, suggesting a link farm or a distribution mechanism for further malicious content. The document body itself is heavily obfuscated and contains some of the same URLs, reinforcing the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://comparefoldersapp.com/uploads/1/3/0/6/130605462/2612428.pdf
    • http://mediherba.com/uploads/1/3/0/4/130483429/xuwuli_kudumip_kiwiropul.pdf
    • http://restaurantwaterloo.nl/uploads/1/3/0/8/130814601/2074826.pdf
    • http://smallbusinesswebdesign.company/uploads/1/3/0/6/130640025/6637253.pdf
    • http://thswebpages.org/uploads/1/3/0/2/130287246/vokufapesiniwipot.pdf
    • http://redwingaidoctor.com/uploads/1/3/0/5/130588830/4155309.pdf
    • http://bodysoulhealing.net/uploads/1/3/0/5/130589058/7357315.pdf
    • http://ccpstl.org/uploads/1/3/0/5/130540116/defdc231bc2f23.pdf
    • http://boganesque.com/uploads/1/3/0/6/130620585/xofig.pdf
    • http://mrstodd.net/uploads/1/3/0/6/130622007/e274a9.pdf
    • http://storybrooke.club/uploads/1/3/0/5/130590208/e671b1d77525.pdf
    • http://graysay.tech/uploads/1/3/0/3/130312944/225669.pdf
    • http://bikespinning.com/uploads/1/3/0/6/130622042/d9aecbc.pdf
    • http://wallepikkers.nl/uploads/1/3/0/6/130639672/6291532.pdf
    • http://michaelshusko.com/uploads/1/3/0/3/130313336/difofavanivedazewo.pdf
    • http://thehot-boxcompany.com/uploads/1/3/0/3/130323412/runivodibubikukipumu.pdf
    • http://6c6f7665.org/uploads/1/3/0/7/130776755/1d90c6a.pdf
    • http://stillhangry.com/uploads/1/3/0/7/130775446/381593.pdf
    • http://m4wq84.bdgct.com/uploads/1/3/0/5/130588573/130588573.html#tnt+ac+dc+chords+and+lyrics

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000131f.bin
749a8194aceec9ce8b1bd1ff0fa9f74936055ca1610102ee16c5e72bd996c9fe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x131F 8032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.