Malicious PDF — malware analysis report

Static analysis result for SHA-256 7fda68f39013bac3…

MALICIOUS

PDF

45.8 KB Authoring application: Smallpdf Desktop
MD5: f7e9be0488ad5506e32960e92d051514 SHA-1: 10a076fda64b8ddd401bb36746d5aab35a212e99 SHA-256: 7fda68f39013bac3b3045d05098d8852ed9292b52a73ff6adb1234e02db5f1e6
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a coordinated effort to manipulate search engine results or distribute malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://healthylivingforallages.net/uploads/1/3/0/5/130589135/pepof.pdf
    • http://meridian.group/uploads/1/3/0/6/130604791/8678769.pdf
    • http://algaebookandpaper.com/uploads/1/3/0/6/130603769/97accaf830c8c.pdf
    • http://gottaluvthatbling.com/uploads/1/3/0/5/130588999/zizufiletinaruw.pdf
    • http://lovelabridal.net/uploads/1/3/0/2/130274017/lojodojexinovagum.pdf
    • http://rbjewellery.co.uk/uploads/1/3/0/2/130272600/nisabuf.pdf
    • http://ollingdevotions.com/uploads/1/3/0/8/130815097/8227557.pdf
    • http://yawenyang.com/uploads/1/3/0/3/130313173/dokedapub-refiliza-fugesuwefiwepa.pdf
    • http://slblevins.com/uploads/1/3/0/6/130604083/saxewikugebenavagu.pdf
    • http://mymontagne.com/uploads/1/3/0/8/130814248/2d0d8.pdf
    • http://mmbabysitting.com/uploads/1/3/0/5/130588998/datuguxudipika-jukavebogefo-waxodumipowoxet-fofugonizel.pdf
    • http://vk-podarki.site/uploads/1/3/0/8/130813548/670175.pdf
    • http://myzticisle.net/uploads/1/3/0/6/130620919/demut-xunugewepugip.pdf
    • http://musicandpeople.com/uploads/1/3/0/8/130873848/6364656.pdf
    • http://karlasertel.com/uploads/1/3/0/3/130313132/7830049.pdf
    • http://www.lombokheros.org/uploads/1/3/0/6/130621203/bupisukepu-jopeja.pdf
    • http://cosmicbrushes.com/uploads/1/3/0/4/130489377/maselafupu.pdf
    • http://eventshutter.com/uploads/1/3/0/5/130550729/83338701.pdf
    • http://emily-kenyon.com/uploads/1/3/0/5/130541209/tebaziv.pdf
    • http://floorcaremaintenance.com/uploads/1/3/0/2/130288492/950390.pdf
    • http://halful.com/uploads/1/3/0/5/130550956/c8886592fa.pdf
    • http://intuitive-marketplace.com/uploads/1/3/0/7/130776672/691171.pdf
    • http://mindfulnessmatters.online/uploads/1/3/0/6/130640139/jimulozuv.pdf
    • http://cuestionsocial.com/uploads/1/3/0/4/130483872/buwarodabesokuto.pdf
    • http://elloello.com/uploads/1/3/0/4/130488273/galize.pdf
    • http://d4pg5.bpmtc.com/uploads/1/3/0/5/130543052/130543052.html#assassin%27s+creed+brotherhood+game+time

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005098.bin
a93f1a58d1a9f2989e9d9a9e319b0c8dac482d9f28209e39f5b7412c7224dd2b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5098 7576 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.