Malicious PDF — malware analysis report

Static analysis result for SHA-256 67cbfe3bae10b823…

MALICIOUS

PDF

33.1 KB Authoring application: PDFedit
MD5: 3550862f0894277bad052f801eaad219 SHA-1: 96cdaa425fcfd7a462d656ce602c8d670614f830 SHA-256: 67cbfe3bae10b8232bc4f0217902f5a0538ede39998de21c07f66eca19e25050
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The PDF contains a large number of embedded URLs pointing to other PDF files, suggesting a link farm or a distribution mechanism for further malicious content. While no explicit script was extracted, the presence of embedded URLs within a PDF is often associated with JavaScript execution for redirection or exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://psychologiesourcecode.com/uploads/1/3/0/5/130550809/823866143.pdf
    • http://oginnovate.com/uploads/1/3/0/7/130776026/0594b6003cfc.pdf
    • http://easternhomeinspect.com/uploads/1/3/0/2/130270967/3813425.pdf
    • http://greatguys.org/uploads/1/3/0/7/130775288/7702862.pdf
    • http://digitlytics.net/uploads/1/3/0/6/130621142/5998524.pdf
    • http://discourse-x.com/uploads/1/3/0/6/130620366/xukererubolawuniguv.pdf
    • http://whiteoutfilms.ca/uploads/1/3/0/2/130288864/3483694.pdf
    • http://tomsalf.store/uploads/1/3/0/6/130620197/ludozuvu.pdf
    • http://klimon.net/uploads/1/3/0/2/130273915/11a6c.pdf
    • http://webazoo.com/uploads/1/3/0/6/130621757/502677.pdf
    • http://macmanuscook.com/uploads/1/3/0/4/130436127/6628098.pdf
    • http://rgvfest.com/uploads/1/3/0/2/130272586/f8dd4c95.pdf
    • http://microblading-amsterdam.com/uploads/1/3/0/5/130539448/likenamuz-zemoma-jorib.pdf
    • http://theotherevilsister.com/uploads/1/3/0/7/130775119/jadujojek.pdf
    • http://courtjeremiah.com/uploads/1/3/0/4/130492038/lonexunirexipat.pdf
    • http://tyningsclimbers.co.uk/uploads/1/3/0/4/130435578/kuginiboru_juvojasar.pdf
    • http://sssrugh.com/uploads/1/3/0/6/130605471/jujekakan.pdf
    • http://a1412531xstreamtravel.xsideas.com/uploads/1/3/0/7/130775261/lewizojedarasu.pdf
    • http://1sx.brdge.org/uploads/1/3/0/5/130589078/130589078.html#latest+tamil+magazines+pdf+free+download
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001992.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1992 2652 bytes
font_01_sfnt_off00002512.bin
fffaac950c9c4525181ddeddb3a5ba8a27722476c7714cb5706dcea5778798de		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2512 7208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.