Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b95fb27199e9afd…

MALICIOUS

PDF

36.5 KB Authoring application: OpenOffice.org
MD5: f207a0c0aef0f29bd5c14739011b9fe1 SHA-1: bc6c4ddc810043e9b5cad48a06723599e46349c8 SHA-256: 7b95fb27199e9afd3879936bdecd3f87e8bc1ab5fb7da0ecf003890a6fb9b3cc
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The PDF_SEO_LINK_FARM heuristic identified a large number of external links, primarily pointing to other PDF files hosted on various domains. This suggests a link-farming or redirection scheme, likely for SEO manipulation or to distribute further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://aspyr.co.uk/uploads/1/3/0/5/130547116/pelonokaxededoperi.pdf
    • http://grahamcooley.com/uploads/1/3/0/2/130273894/welaxig.pdf
    • http://kelseyhopebrewer.com/uploads/1/3/0/4/130488063/wesomiludej_lixupe.pdf
    • http://www.my-thm-story.blog/uploads/1/3/0/9/130969618/zujilexodegilimave.pdf
    • http://www.ppsid.com/uploads/1/3/0/4/130483703/zegewumesawadurebav.pdf
    • http://minigypsyhorse.com/uploads/1/3/0/6/130639192/1715044.pdf
    • http://nurtureministries.com/uploads/1/3/0/5/130545484/5201980.pdf
    • http://tripsupplies.shop/uploads/1/3/0/6/130622061/2572373.pdf
    • http://travelenjoy.net/uploads/1/3/0/5/130541285/galatejebegifat-wiwakuvovo-nebewaxilebef.pdf
    • http://teacupsanddresses.com/uploads/1/3/0/7/130775806/a44e16.pdf
    • http://jzia.com/uploads/1/3/0/2/130287915/363412.pdf
    • http://columbiacountysnowfest.com/uploads/1/3/0/4/130476616/topeba-wumawiw-gezopadobolegan.pdf
    • http://brandpants.com/uploads/1/3/0/5/130590122/dubixakovedigu.pdf
    • http://thecottonlickers.com/uploads/1/3/0/3/130312925/4730111.pdf
    • http://a1893059xstreamtravel.xsideas.com/uploads/1/3/0/6/130605403/130605403.html#nescafe+dolce+gusto+jovia+capsules

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003319.bin
9d45d601dacd0eddc713a6615ef5202adece8f81f6a787aefb40fbe3a26ca1aa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3319 8660 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.