PDF malware analysis — malicious · 6c6b412c25d71d0a

MALICIOUS

PDF

45.6 KB Authoring application: Smallpdf Desktop

MD5: 9d43cf2ed0b60bb5e1d2ef48ab1a5ff4 SHA-1: 291f4b6e4ba66469f1f121ed5388f6f097358235 SHA-256: 6c6b412c25d71d0a0ca1114bfc22ca0c9bf5680c675f314b9af148b87e0e9865

160 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many of which point to other PDFs, indicating a link farm designed to distribute malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware delivery. Although no scripts were explicitly extracted, the PDF structure and embedded URLs are indicative of a malicious campaign.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON

Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://airythinness.com/uploads/1/3/0/9/130969673/2c246830104.pdf
- http://mysmilepaparazzi.com/uploads/1/3/0/7/130739385/musatod-tunizosavumu-pitaregom-tebezowefilapo.pdf
- http://waea.net/uploads/1/3/0/2/130289266/311988.pdf
- http://electricsalad7.com/uploads/1/3/0/5/130539437/8c05c77d676.pdf
- http://www.abreanutrition.com/uploads/1/3/0/3/130323465/8f3139.pdf
- http://bygamerzforgamerz.com/uploads/1/3/0/6/130621689/be1fb8d10862062.pdf
- http://findthatpartyplanau.net/uploads/1/3/0/5/130542859/vavanojerewexuxoju.pdf
- http://hairbyheirgroom.com/uploads/1/3/0/6/130621732/zotovokota.pdf
- http://mexicofolk.net/uploads/1/3/0/6/130621815/gonivemazusukumujuj.pdf
- http://women40260.com/uploads/1/3/0/7/130775076/8bcf309.pdf
- http://creatorsdigitalmm.com/uploads/1/3/0/8/130873796/8f3f3255.pdf
- http://stormikc.net/uploads/1/3/0/6/130604848/timabejipapov-vurazimabof.pdf
- http://madeinvenice.net/uploads/1/3/0/6/130604737/ec42966f.pdf
- http://cnmelotti.com/uploads/1/3/0/4/130483592/geperekinape.pdf
- http://sydneyft.com/uploads/1/3/0/7/130739897/7754c44e1e.pdf
- http://platicus.net/uploads/1/3/0/4/130476237/410aae1d96b.pdf
- http://www.guitarlessonsbath.net/uploads/1/3/0/2/130289399/25631ff42cd.pdf
- http://eneduerabe.org/uploads/1/3/0/9/130969149/vajivevexulumolumag.pdf
- http://solidsoluions.com/uploads/1/3/0/2/130270873/tudamoper.pdf
- http://tedi.com.co/uploads/1/3/0/6/130621938/7537474.pdf
- http://ryantakeo.com/uploads/1/3/0/2/130292014/9728128.pdf
- http://mail.ledsignal.gr/uploads/1/3/0/7/130775962/3263425.pdf
- http://forestacresmusicschool.org/uploads/1/3/0/5/130544070/3180971.pdf
- http://hostmaster.thelastwordcocktail.com/uploads/1/3/0/5/130589460/sabifu-mamuzoxid.pdf
- http://cpanel.dickersongreenseminary.org/uploads/1/3/0/3/130323527/130323527.html#best+pdf+editor+free+mac

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00004df8.bin` `03aca1bf71fada41265f87e3f34e59045c87f876cc28d1ccbf36cfd61860b609`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4DF8	8472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.