Malicious PDF — malware analysis report

Static analysis result for SHA-256 742077216c4e1fc9…

MALICIOUS

PDF

35.5 KB Authoring application: Adobe PDF Library 9.0
MD5: 33c0ef8ad259aa57114220dc27c7af27 SHA-1: afdd3b782ec21130410fb4e2cba2117b93c3f47a SHA-256: 742077216c4e1fc917547d0c4ea8ee8f741aaccc5a82bd66fdeb4515e2927717
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged as malicious by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection. The document contains a large number of embedded URLs pointing to other PDF files, suggesting a link farm or redirection scheme. While no scripts were explicitly extracted, the nature of the PDF and the embedded URLs indicate a potential phishing or malicious content distribution vector.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pastmaster.org/uploads/1/3/0/6/130639100/losesujetemom-guvigi-xurilatidakoxe-dakazupoj.pdf
    • http://abdullahalmaruf.com/uploads/1/3/0/3/130379298/3e84ee33b84e14b.pdf
    • http://pwhs.prowrestlinghistoricalsociety.com/uploads/1/3/0/4/130435844/da39ab.pdf
    • http://stephan-orth.net/uploads/1/3/0/4/130488662/9845740.pdf
    • http://tuslawmustangsfootball.com/uploads/1/3/0/4/130488416/xoxaraxogofuzuxitiza.pdf
    • http://sproutmagazine.org/uploads/1/3/0/4/130476970/vegotawuze.pdf
    • http://sauerlandhypotheek.nl/uploads/1/3/0/5/130543106/130543106.html#solar+panels+how+they+work+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000112c.bin
2963622c47c123c6e160cb2d53a59e7c1b07009e03f9c30b0f0c36caf63150e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x112C 7872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.