PDF malware analysis — malicious · 69c93ded5b434cb6

MALICIOUS

PDF

44.9 KB Authoring application: pdf-parser

MD5: 21f6d51188535e5f6ce1c3019902705d SHA-1: f054722d6c71cbeb4dd70126a4e9045e956a4591 SHA-256: 69c93ded5b434cb69cb9494ac0aec23de1cde1e5e07896f2bb1da399d0333609

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of embedded URLs pointing to external PDF files, suggesting a link farm or a distribution mechanism for further malicious content. The document body is heavily obfuscated and does not provide clear instructions, but the overall structure and URL distribution indicate a malicious intent, likely related to phishing or SEO spam.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://mimismushrooms.com/uploads/1/3/0/7/130776403/3986747.pdf
- http://wrhslax.com/uploads/1/3/0/6/130621772/xozubogi-supiriradi.pdf
- http://lipworthy.com/uploads/1/3/0/8/130874533/vuwalabulimanil.pdf
- http://jmjfunding.net/uploads/1/3/0/7/130739758/ririgokezizi-silefeniwibi-sawapalavewo-netazoxuwatinuv.pdf
- http://sharephotoset.com/uploads/1/3/0/8/130874025/f57c37.pdf
- http://twincerelyyoursfw.com/uploads/1/3/0/2/130291463/6285613.pdf
- http://scottgieser.com/uploads/1/3/0/3/130379172/tijefopanonabirize.pdf
- http://driftcalifornia.com/uploads/1/3/0/7/130776037/zafedavin.pdf
- http://jtaginterface.net/uploads/1/3/0/7/130776271/lasogam_jojopavo_mizelibukebuf_ganixe.pdf
- http://hairbyalex29.com/uploads/1/3/0/7/130775252/daruxeku-sibosokebud.pdf
- http://www.sciartcenter.org/uploads/1/3/0/7/130739498/2171ffcc3.pdf
- http://unifiedbrewing.net/uploads/1/3/0/2/130289154/2745dad6a.pdf
- http://newspinmeasure.net/uploads/1/3/0/5/130590154/fb4a2d.pdf
- http://southernparadisecatering.com/uploads/1/3/0/5/130548152/2861920.pdf
- http://danadrakedesign.com/uploads/1/3/0/8/130874519/gagubakewirotasajuli.pdf
- http://mrskramlsclass.com/uploads/1/3/0/2/130289571/2854598.pdf
- http://consolineaudiovisual.com/uploads/1/3/0/5/130588195/jetofadodivat-xojurumemo-kilozu-lovukudotoni.pdf
- http://thecookiieeejar.com/uploads/1/3/0/8/130813876/1822472.pdf
- http://tcuroxo.com/uploads/1/3/0/7/130738912/zuwiduvojuniwixile.pdf
- http://kremerfamily.net/uploads/1/3/0/6/130621002/radusudole.pdf
- http://srilankanprivatedriver.com/uploads/1/3/0/7/130739072/baxebulanewo.pdf
- http://ivjournal.org/uploads/1/3/0/4/130483956/7264322.pdf
- http://y0x3n.slpny.com/uploads/1/3/0/7/130775803/130775803.html#peak+output+voltage+of+bridge+rectifier
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004088.bin` `1110447959503c75238c0f1bcdf9de7fad567fc767730a4530dcb0d3a64541bd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4088	2696 bytes
`font_01_sfnt_off00004ca2.bin` `964efb213d8efe3c00c724768464f9d010dfcb3343ecaa69d422f55d70495939`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4CA2	8324 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.