Malicious PDF — malware analysis report

Static analysis result for SHA-256 63e9b2c4bf43ae60…

MALICIOUS

PDF

35.0 KB Authoring application: PDFedit
MD5: 6f61e2b93d961bab5d8f7e6521cfbb75 SHA-1: c97ba14f3a5274846acde4106bbb9a9b6fdd4276 SHA-256: 63e9b2c4bf43ae60ca20497ce61c67d49f46d6d64c0ddc644524b2e3fa02d500
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on various domains. This pattern is indicative of SEO manipulation or a phishing campaign designed to redirect users to potentially malicious content. While no scripts were explicitly extracted, the heuristic 'PDF_SEO_LINK_FARM' strongly suggests malicious intent through link farming. The ML classifier and ClamAV detection further corroborate the malicious nature of the file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://park-summit.com/uploads/1/3/0/6/130621072/2615193.pdf
    • http://www.ivyandroses.com/uploads/1/3/0/6/130621026/buzafavenivages.pdf
    • http://holy-post.net/uploads/1/3/0/3/130324170/1280526.pdf
    • http://reneuhair.net/uploads/1/3/0/2/130288762/rekutosobakige.pdf
    • http://starlightdjservices.com/uploads/1/3/0/7/130775278/20bb8.pdf
    • http://a-ive.club/uploads/1/3/0/6/130604735/rifituketupovos.pdf
    • http://hr-serious.com/uploads/1/3/0/8/130814232/zujasigipusev.pdf
    • http://tallahasseespraywash.com/uploads/1/3/0/6/130639884/9081242.pdf
    • http://asociaciondepastores.net/uploads/1/3/0/4/130488096/mibepazalu.pdf
    • http://digitaldissident.com/uploads/1/3/0/8/130874035/losatuzapudikake.pdf
    • http://deltamarketing.ms/uploads/1/3/0/6/130603866/2142135.pdf
    • http://trinityjamestown.net/uploads/1/3/0/7/130775376/6248091.pdf
    • http://shoprvcusa.net/uploads/1/3/0/5/130588627/683221.pdf
    • http://celebrationcatering.net/uploads/1/3/0/6/130605010/080c2e8ffa0d1ff.pdf
    • http://sugarheal.com/uploads/1/3/0/7/130775714/d5350bbd5.pdf
    • http://sugarvedelmiesmunkavedelmikft.com/uploads/1/3/0/6/130620813/fefiki.pdf
    • http://drtoxie.com/uploads/1/3/0/5/130550925/siligu.pdf
    • http://www.maidcleaningeasyforyou.com/uploads/1/3/0/6/130604126/130604126.html#iceland+map+world

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c54.bin
735adb6f1f9b69890bc40186719206a898ad74a3b38d3fdd4a6e02f4d4ed526d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C54 7884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.