Malicious PDF — malware analysis report

Static analysis result for SHA-256 63466c6ec0d0e846…

MALICIOUS

PDF

35.4 KB Authoring application: Poppler-utils
MD5: 08dbd654869b85d0fa763fef8d7a26f4 SHA-1: ce20c0ee2d957de1c5005eb26a5ffe681f7d2360 SHA-256: 63466c6ec0d0e84670dfa6027acb7050c313685c108e29c115c53c13230e908d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by multiple heuristics, including a critical finding for a large external PDF link farm. The embedded URLs likely lead to malicious content or phishing pages, suggesting a phishing or content redirection attack. No scripts were extracted, and the document body contained mostly obfuscated or binary data.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://aegomics.com/uploads/1/3/0/5/130588590/6143474.pdf
    • http://catvaloreaza.com/uploads/1/3/0/7/130739099/beee65d.pdf
    • http://www.rainbowdollhouses.store/uploads/1/3/0/5/130545128/4471477.pdf
    • http://dirtbagmagazine.com/uploads/1/3/0/4/130484005/kibogi_xabajaxoru_bizipadodufupu_pizobetet.pdf
    • http://akasharae.com/uploads/1/3/0/6/130621373/didimadamazu-mimit-kebiwaguropin.pdf
    • http://housetagger.com/uploads/1/3/0/4/130490585/bb90a0.pdf
    • http://jstepp.net/uploads/1/3/0/5/130542734/vuvopomidalo.pdf
    • http://signals.email/uploads/1/3/0/6/130604034/6094487.pdf
    • http://linushapka.com/uploads/1/3/0/7/130739970/sedinewazakilut.pdf
    • http://rickmillscounseling.com/uploads/1/3/0/6/130604286/66fb8568f8be1.pdf
    • http://vfmarket.net/uploads/1/3/0/6/130604834/vurejaxuwarotujewa.pdf
    • http://magicalcryptofriend.com/uploads/1/3/0/5/130540155/6fa6284c376d65.pdf
    • http://teach-ng.com/uploads/1/3/0/6/130621330/zoxuxasotugiza_zusow.pdf
    • http://thebutchersblocksouthaven.com/uploads/1/3/0/4/130435922/jugajubi-segiti.pdf
    • http://oscarsterte.com/uploads/1/3/0/2/130273735/8195996.pdf
    • http://playrezball.com/uploads/1/3/0/6/130604723/juwef.pdf
    • http://mxsnot.com/uploads/1/3/0/3/130323180/1133045.pdf
    • http://rahimlovesnena.com/uploads/1/3/0/3/130379266/mizulanojemuj.pdf
    • http://www.deboraholmes-aspiritmessage.com/uploads/1/3/0/8/130813601/sixojog_pumakewun_powobitonu.pdf
    • http://bkrht5.bdgct.com/uploads/1/3/0/5/130547142/130547142.html#gy-521+arduino+nano+wiring

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000029d1.bin
7e6923815ca73aab63dcb2848c67b26cf53755fc21f359e01b39101d93920162		 pdf-font-stream PDF embedded font (sfnt) at offset 0x29D1 8628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.