Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d9a8f7ff2a24d15…

MALICIOUS

PDF

64.5 KB Authoring application: Serif PagePlus
MD5: e60396b3ed47e9d92c65800d5d619228 SHA-1: 284ff6a7b26b957344a64d90ff74c086b8c2e761 SHA-256: 7d9a8f7ff2a24d157794e1d63f511c7fbf9d115e169a0aebbc7a74b86764ad95
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of external links, as indicated by the 'PDF_SEO_LINK_FARM' heuristic. These links point to various domains, suggesting a link farm or redirection infrastructure. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent, likely related to phishing or traffic redirection. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pcs1.com/uploads/1/3/0/7/130775932/6e85553660.pdf
    • http://drberrycoaching.com/uploads/1/3/0/5/130540116/pekezuzinoka.pdf
    • http://afslankbuddy.com/uploads/1/3/0/5/130539599/wuvulugisonu.pdf
    • http://waltzerbooth.com/uploads/1/3/0/4/130435702/dutokarodes.pdf
    • http://xiaoyouqipaixiazai.br3h.com/uploads/1/3/0/6/130620679/5419348.pdf
    • http://apartmentsbastion.com/uploads/1/3/0/7/130738506/fikifeliwo-kikapefefetowir.pdf
    • http://www.driftawaylbr.com/uploads/1/3/0/2/130274169/624317e80.pdf
    • http://claytonheightssportmassage.ca/uploads/1/3/0/6/130621055/3640272.pdf
    • http://mx.kellyfeger.com/uploads/1/3/0/8/130814254/46e120.pdf
    • http://saintta.net/uploads/1/3/0/5/130544413/romobigoxevod.pdf
    • http://miacurcargo.com/uploads/1/3/0/7/130775723/mofabof.pdf
    • http://surebuildlandscaping.com/uploads/1/3/0/7/130775772/4287437.pdf
    • http://barriebasketball.com/uploads/1/3/0/5/130539837/a1ba3ad7834e28b.pdf
    • http://bhsfineartsboosters.org/uploads/1/3/0/6/130639336/130639336.html#t%E1%BA%A3i+foxit+reader+full+crack+m%E1%BB%9Bi+nh%E1%BA%A5t

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00007e1b.bin
d7373efc48c2102ba523fbd68e03b35956a81cae2f7f443304b5ad2a83dab2e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E1B 24452 bytes
font_01_sfnt_off0000a065.bin
6c0afdc016629d2da4ed195b6624415acaadfeb5e3fb00fc90a18d836e5b32da		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA065 12196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.