Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e846180865644a3…

MALICIOUS

PDF

32.0 KB Authoring application: Smallpdf Desktop
MD5: ccf6e10a9ae6b5744775ad0ef419e231 SHA-1: cdfc8837b833abe75d40c21d3e13bde3af413f38 SHA-256: 6e846180865644a3ad569dc7b99b7c4105e10b5147e7d35156d41648af33a430
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files hosted on various domains. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or SEO abuse. While no scripts were explicitly extracted, the embedded URLs themselves are the primary indicators of compromise, suggesting a campaign to distribute malicious content or manipulate search engine results.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wileybrands.com/uploads/1/3/0/6/130621305/lolefuvewijur.pdf
    • http://raisingthebaar.org/uploads/1/3/0/6/130639334/joxuleme.pdf
    • http://www.secondlayerconsulting.com/uploads/1/3/0/7/130739427/vasajizexefutemor.pdf
    • http://nathanael-cook.com/uploads/1/3/0/4/130435717/ff9425ef0663.pdf
    • http://in-kindness.com/uploads/1/3/0/3/130379104/6428925.pdf
    • http://mail.cv-loerrach.de/uploads/1/3/0/9/130969373/muruba.pdf
    • http://cassiescreations.com/uploads/1/3/0/2/130287898/a85f2d7e.pdf
    • http://zjonesrealty.com/uploads/1/3/0/6/130639259/2791729.pdf
    • http://relicwinecellars.com/uploads/1/3/0/5/130551567/534e4542.pdf
    • http://adwiorganics.com/uploads/1/3/0/8/130874264/8973337.pdf
    • http://wineandwhiskey.net/uploads/1/3/0/5/130539265/gelukakopen.pdf
    • http://monalisatravelling.com/uploads/1/3/0/4/130476747/1301a89bae4fb89.pdf
    • http://canyonlaketax.com/uploads/1/3/0/6/130604598/tupusotipuno.pdf
    • http://racycostumes.com/uploads/1/3/0/4/130478551/rojevexa.pdf
    • http://brauchconsumerlaw.com/uploads/1/3/0/4/130490250/bajematataruj-jopulukoguf.pdf
    • http://35thavenuebaptist.com/uploads/1/3/0/4/130488241/jiminaxojadagagowix.pdf
    • http://getfurnitureleads.com/uploads/1/3/0/6/130604488/mufaj-winupagubijikov-suxife-kukolusok.pdf
    • http://womensspiritcenter.com/uploads/1/3/0/3/130323647/rigof.pdf
    • http://thedadadvice.com/uploads/1/3/0/9/130969761/muxenomaguluritogiju.pdf
    • http://apus-arts.com/uploads/1/3/0/9/130969847/26498bb5b763998.pdf
    • http://bdcglobalpng.com/uploads/1/3/0/2/130287737/xobibuzori.pdf
    • http://martinacamilleri.net/uploads/1/3/0/7/130740465/vezetono.pdf
    • http://hxqh8.bpmtc.com/uploads/1/3/0/3/130323884/130323884.html#advanced+sql+injection+tutorial+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001d08.bin
9d74b8f0a800e9c95f8704547c861f1a54627e0eff03a05cc3cbadbbff9dde87		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D08 7280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.