Malicious PDF — malware analysis report

Static analysis result for SHA-256 65d70922556794c0…

MALICIOUS

PDF

37.0 KB Authoring application: Nitro PDF
MD5: 3a2802cde179eb8675ebe2d5f54f80a8 SHA-1: 531592509a40657e37ceb10b310176584c0ceec6 SHA-256: 65d70922556794c0a58f03068490a6813c51092f40477590e7a1c269d7fc42a3
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and a ML classifier. It contains a large number of embedded URLs pointing to other PDF files, suggesting a link farm or a distribution mechanism for further malicious content. The presence of embedded URLs and the nature of the PDF_SEO_LINK_FARM heuristic indicate a potential for phishing or malware distribution, aligning with the T1566.001 (Spearphishing Attachment) technique.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nhsilbert.net/uploads/1/3/0/6/130620796/rosepojewovo-madewixesoledip.pdf
    • http://advancedspeedtechnologies.com/uploads/1/3/0/6/130640024/7380656.pdf
    • http://childrensliteratureandreading.org/uploads/1/3/0/2/130291365/4527331.pdf
    • http://rachnayoga.com/uploads/1/3/0/7/130738944/8e6778d84.pdf
    • http://nmpstag.com/uploads/1/3/0/4/130491075/xepevumolapebu_nozaxisugolokeb_wijeju.pdf
    • http://shotz.website/uploads/1/3/0/5/130588415/5683770.pdf
    • https://dajejapukade.weebly.com/uploads/1/3/0/5/130589416/xonagodemuk_wolubuku_dileren.pdf
    • http://bodyworkbybarb.com/uploads/1/3/0/7/130776826/68dbc76a53c14.pdf
    • http://ooredoopalestine.net/uploads/1/3/0/4/130494389/pakojovijofo.pdf
    • http://rebeccalaplacaattia.com/uploads/1/3/0/6/130604018/130604018.html#kpss+%C3%B6nlisans+soru+bankas%C4%B1+2018+indi

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001475.bin
3a2e0e06759754920679415ac0ee04f0191eb66ad066746636b497e35daeae71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1475 9892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.