Malicious PDF — malware analysis report

Static analysis result for SHA-256 81d71151d5043764…

MALICIOUS

PDF

36.2 KB Authoring application: Solid Converter PDF
MD5: 5fb11c443c7750ccd32be3e4cb26c56e SHA-1: 0a7d729a4a766d1b80daede53799254683fdfde6 SHA-256: 81d71151d5043764611c4ea9f3b70e449fb78b67340970fdd9ea4b85ce150b6e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, classifying it as phishing-related malware. No scripts were extracted, but the sheer volume of external links suggests a coordinated effort to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://geeksmind.com/uploads/1/3/0/4/130483062/9381096.pdf
    • http://kentuckyroutezero.net/uploads/1/3/0/6/130620584/4819971.pdf
    • http://thereserveatgoldhills.com/uploads/1/3/0/5/130589353/ronowemelu.pdf
    • http://maydaypress.net/uploads/1/3/0/5/130551186/jupexazomoveluw_tezirodosokipir.pdf
    • http://op1620.com/uploads/1/3/0/5/130550756/tujutame_wexar_lekimivori.pdf
    • http://togetherweserve.xyz/uploads/1/3/0/4/130476921/jalitugixapasadonebi.pdf
    • http://pitrend.net/uploads/1/3/0/3/130313056/1372980.pdf
    • http://silberszaune.com/uploads/1/3/0/3/130323180/5f0ca073f6.pdf
    • http://jessdentoncreative.com/uploads/1/3/0/5/130551477/vuwoxog-lazogarutiz.pdf
    • http://dirtboxdisco.co.uk/uploads/1/3/0/7/130775979/14700b7383.pdf
    • http://teeshopbae.com/uploads/1/3/0/9/130969703/1228930.pdf
    • http://mta-sts.mail.massageformommies.com/uploads/1/3/0/4/130477074/xesenabewip.pdf
    • http://captreefishingboat.com/uploads/1/3/0/3/130323421/3467229.pdf
    • http://stlouiswireless.net/uploads/1/3/0/2/130287529/5378105.pdf
    • http://bunnystravel.com/uploads/1/3/0/5/130588370/lajinu.pdf
    • http://74-123-79-231.mgwnet.com/uploads/1/3/0/8/130813548/130813548.html#caso+clinico+hernia+de+disco+lombar

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000032c6.bin
7f2ae14254e883a3f69b22c75b9406062148b9409ca00a33339b2ef8760f1b39		 pdf-font-stream PDF embedded font (sfnt) at offset 0x32C6 9276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.