Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ba14e6e5669cc9b…

MALICIOUS

PDF

32.1 KB Authoring application: pstoedit
MD5: b68a5bc3955da30ab74e8804e5cf0b50 SHA-1: 686b5f24b1a264b32c0c9c25b7e50102d289cdd2 SHA-256: 6ba14e6e5669cc9ba00aaf79637e08fc5899341f501bacc854266b5ac212e44d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection scheme. The ML_NYX_PDF_MALICIOUS and ClamAV detections confirm its malicious nature, likely as a phishing or malware distribution lure. No scripts were extracted, but the embedded URLs are the primary indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://obxaerialads.com/uploads/1/3/0/6/130621369/rusesopefan_sokevolutiwup_xarutogu_tomepe.pdf
    • http://millwoodsphysiotherapy.com/uploads/1/3/0/5/130542907/wetozexu-fenifewuxut-potozipod-vexuj.pdf
    • http://fairvotepiercecounty.com/uploads/1/3/0/4/130476784/xunuzur_ramobojo.pdf
    • http://newrisestrategy.com/uploads/1/3/0/6/130621458/012f34.pdf
    • http://zikabrazil.com/uploads/1/3/0/3/130379517/loliwubu.pdf
    • http://diamondmarvel.com/uploads/1/3/0/4/130489604/3792491.pdf
    • http://djmichaelsimon.com/uploads/1/3/0/5/130543256/4297619.pdf
    • http://susanmastalsfoundation.org/uploads/1/3/0/5/130588672/gexugewufufe_rufunuwixal_pularari.pdf
    • http://jandwcleaningteam.net/uploads/1/3/0/3/130313634/9762002fb8.pdf
    • http://menuxez.vkbonus.fun/uploads/2020/01/28/879037.pdf
    • http://misssupremepurityqueen.com/uploads/1/3/0/5/130588426/130588426.html#absolute+monarchs+in+europe+chapter+21+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000146e.bin
a2343a2c9f5802b2e26501f5b0aeb56aefa50f3fc5ccd9256115f19a3f28b404		 pdf-font-stream PDF embedded font (sfnt) at offset 0x146E 8164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.