Malicious PDF — malware analysis report

Static analysis result for SHA-256 74b295338691cf27…

MALICIOUS

PDF

36.9 KB Authoring application: Pdftk
MD5: e9e907dfb3d273dfbcbd2f6c17a72aee SHA-1: 1f390f12dfcd88ee5e94c154cbbb36cf95463912 SHA-256: 74b295338691cf275b360c7ddcf47e1de8c4366c16ecb46593e96f6470e6f3d2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of embedded URLs pointing to other PDF files, suggesting a link farm or a distribution mechanism for further malicious content. The document body appears to be corrupted or obfuscated, preventing a clear understanding of its immediate lure, but the overall structure strongly indicates malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pereraholdings.com/uploads/1/3/0/6/130604894/megimojadixa-jigefifonuxego-fukov.pdf
    • http://hartmando.org/uploads/1/3/0/5/130589094/nepubalob.pdf
    • http://www.theesthers.org/uploads/1/3/0/7/130739951/cac56b63eeca078.pdf
    • http://www.rtcranch.com/uploads/1/3/0/5/130538869/1847420.pdf
    • http://metuchendentistry.com/uploads/1/3/0/5/130539130/6894566.pdf
    • http://ark47.com/uploads/1/3/0/6/130621119/f6801f28.pdf
    • http://moreofthenatural.com/uploads/1/3/0/3/130323566/jeguk.pdf
    • http://rbstrength.com/uploads/1/3/0/6/130621952/9835789.pdf
    • http://hcfaith.org/uploads/1/3/0/7/130739415/6135201.pdf
    • http://lecoqusa.com/uploads/1/3/0/3/130379204/4884466.pdf
    • http://bittersweetcocktails.com/uploads/1/3/0/4/130476255/temaveke.pdf
    • http://shansbands.com/uploads/1/3/0/5/130551331/rosozopizekisodevivi.pdf
    • http://anucoffee.com/uploads/1/3/0/4/130488816/boxotulodagudir.pdf
    • http://adiofer.com/uploads/1/3/0/5/130590153/mibefufinexoz.pdf
    • http://hughheffner.net/uploads/1/3/0/8/130874257/2496690.pdf
    • http://golden-rule-global.com/uploads/1/3/0/8/130814586/091f56d7e2c8.pdf
    • http://jmbrecho.com/uploads/1/3/0/8/130874296/pozewo.pdf
    • http://omnium1.in/uploads/1/3/0/9/130969242/14bf4bb5833a.pdf
    • http://kcmwebco.com/uploads/1/3/0/4/130477085/89e15.pdf
    • http://usbsfund.com/uploads/1/3/0/6/130639161/aec3735a775c9f5.pdf
    • http://arise73.pleasingfood.com/uploads/1/3/0/2/130273982/130273982.html#pancreatic+amylase+level

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000317c.bin
8cfbf9129cc3a3959cf45fc5209f65b52ea3edbce69eaf9a830fb032eb8110e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x317C 7856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.