Malicious PDF — malware analysis report

Static analysis result for SHA-256 7afa22c8875ee796…

MALICIOUS

PDF

37.6 KB Authoring application: Solid Converter PDF
MD5: a70a2a946f3ee8a9e95daaed425df035 SHA-1: 425b7ed53e717909dd818f1690beb05923f16339 SHA-256: 7afa22c8875ee796c23a46866d225cec693f5e8ed6b9d10f1bd939c5a2a3f78a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This behavior, combined with the ML_NYX_PDF_MALICIOUS and ClamAV detections, strongly suggests a malicious intent, likely to redirect users to phishing sites or download further malware. The document body itself is heavily obfuscated and contains no clear user-facing text, further supporting the interpretation that the primary function is to host and link to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mail.lifewithlemons.net/uploads/1/3/0/6/130639642/fixaniz_zikuxemuwaka.pdf
    • http://saritelpner.com/uploads/1/3/0/5/130550681/6b01ab1f8b39a3.pdf
    • http://www.lakewaypaddlesports.com/uploads/1/3/0/8/130874325/texigolosuzeji.pdf
    • http://southernbella.net/uploads/1/3/0/5/130550846/d9511f2eec99.pdf
    • http://aikotanaka.com/uploads/1/3/0/7/130776875/pudariderinusu-fowuzenomida.pdf
    • http://bereavementbubbles.com/uploads/1/3/0/4/130483477/3630139.pdf
    • http://xtoid.com/uploads/1/3/0/6/130603958/sobajafasavasuxaxigo.pdf
    • http://coffeewithfriends.ca/uploads/1/3/0/3/130313309/vavile.pdf
    • http://niffianva.com/uploads/1/3/0/2/130270958/d0d5f668.pdf
    • http://ashtangayogaantwerpen.com/uploads/1/3/0/4/130435641/kubobelu_vekixiwaxa_famuruzuki.pdf
    • http://marshfieldcomputerrepair.com/uploads/1/3/0/4/130483216/5359048.pdf
    • http://engadycinevideo.com/uploads/1/3/0/7/130740202/7859401.pdf
    • http://hammeredbyhandpikeplacemarket.com/uploads/1/3/0/8/130873941/9f9b2.pdf
    • http://loveisnothate.net/uploads/1/3/0/4/130488320/sazofo_bazaralemu_nuwuxalad_delizes.pdf
    • http://awmracing.com/uploads/1/3/0/5/130540642/pezumumebabarakofot.pdf
    • http://beverlywilshire.org/uploads/1/3/0/8/130813883/jujon.pdf
    • http://frankmanningmft.com/uploads/1/3/0/2/130272318/1562533.pdf
    • http://ribligion.com/uploads/1/3/0/3/130323672/fuzamurarawuwoful.pdf
    • http://millyproducts.com/uploads/1/3/0/5/130589184/karuvizowa.pdf
    • http://www.stjosephspouseofthevirginmary.net/uploads/1/3/0/4/130494871/nulizugawen_befubepan_dezenulivupavin_wawufatilivodu.pdf
    • http://mtcsrussell.com/uploads/1/3/0/2/130287738/8828241.pdf
    • http://tkrealtysolutionssa.com/uploads/1/3/0/5/130588269/62b1c7edd.pdf
    • http://wcd-qnv77h4.mgh-r.ch/uploads/1/3/0/6/130620631/130620631.html#djvu+to+pdf+converter+online

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030eb.bin
35efb0ea0a6a98991f02f9c0283d97e46e594e06b859cddc686eb378c3283d5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30EB 8012 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.