Malicious PDF — malware analysis report

Static analysis result for SHA-256 7bdc43f565975d49…

MALICIOUS

PDF

32.9 KB Authoring application: pstoedit
MD5: bd0b36a18ea0fb86cd6d6acec5fd8e09 SHA-1: a9f059124ffb09bb053e47594d0caa35a81c48ab SHA-256: 7bdc43f565975d49147ab9a7ce85063bdd53815e6a84f3af1a2948e6e8f73227
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was flagged by multiple detection engines, including a critical heuristic for a PDF link farm and ClamAV detection as phishing malware. The embedded content, though heavily obfuscated, contains numerous URLs pointing to external PDF files, suggesting a tactic to manipulate search engine results or distribute additional malicious content. The presence of embedded URLs and the nature of the heuristics strongly indicate a malicious intent to redirect users to potentially harmful sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://redinkwell.com/uploads/1/3/0/7/130739864/9783784.pdf
    • http://thecraft2draft.com/uploads/1/3/0/2/130288673/7011068.pdf
    • http://www.usafaga.com/uploads/1/3/0/9/130969200/ziwina.pdf
    • http://designavengers.com/uploads/1/3/0/6/130604580/45bb1e1f89b2f0.pdf
    • http://bandyandshinty.com/uploads/1/3/0/6/130620968/66b021.pdf
    • http://coopermanselfdefense.com/uploads/1/3/0/6/130604654/f256744b04aaf.pdf
    • http://mpholistichealth.com/uploads/1/3/0/3/130379227/fadakake_nawiwuriruxubej_jogematesod.pdf
    • http://nutritionrxllc.com/uploads/1/3/0/5/130551249/gokuvunezapubupulor.pdf
    • http://slowvc.com/uploads/1/3/0/5/130545382/368df790398e.pdf
    • http://foggery.com/uploads/1/3/0/5/130588501/7949144.pdf
    • http://jinyouqipaiyouxidating.br3h.com/uploads/1/3/0/7/130775228/130775228.html#reading+charts+and+graphs+worksheets

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c38.bin
82412fd7421abd108ac3e3e6344d13badc732149a0072f4a83488cdc42f64e1a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C38 7360 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.