Malicious PDF — malware analysis report

Static analysis result for SHA-256 822e8f9605589916…

MALICIOUS

PDF

37.5 KB Authoring application: PDF Studio
MD5: 2688f8c36500672eefb7a309eb1149bb SHA-1: 43f625f02e2d82fceb7ed469d80c3633783d46c3 SHA-256: 822e8f96055899162b9670871e4a6e1f32792943f88f110a99a9abde4a0cd9a4
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO spam or to distribute further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The embedded URLs are the primary indicators of compromise, likely serving as lures or redirects to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://spiritualdirectionminstry.com/uploads/1/3/0/5/130551143/rabesipupogi.pdf
    • http://nicolettabuildingcontractors.com/uploads/1/3/0/5/130541384/lafasizanitag-mukanekilurole-bobolu.pdf
    • http://politicallyincorrecttees.com/uploads/1/3/0/6/130604801/laviribabekusu.pdf
    • http://soviet-shrek.com/uploads/1/3/0/5/130550931/davomodijodewizin.pdf
    • http://generosity.website/uploads/1/3/0/7/130740598/60981.pdf
    • http://museandreign.com/uploads/1/3/0/6/130603874/e537fd1c0aa3c.pdf
    • http://peteshotsauce.com/uploads/1/3/0/6/130639296/kisubenilodugi_nodulomado_kuxav_jijeba.pdf
    • http://nytsattui.com/uploads/1/3/0/7/130740363/4a85585dd3.pdf
    • http://cpanel.pokebattles.gfx-pro.net/uploads/1/3/0/6/130622051/853527.pdf
    • http://astoriafilmfest.com/uploads/1/3/0/2/130291874/relirurisetib.pdf
    • http://a-ive.club/uploads/1/3/0/3/130313323/7694246.pdf
    • http://amycashproperties.com/uploads/1/3/0/3/130379193/favesepu-wuwerobozov.pdf
    • http://abraxastattoo.com/uploads/1/3/0/8/130813732/kavideloxo-rujoga.pdf
    • http://scotlandcp.com/uploads/1/3/0/4/130476385/pomuj.pdf
    • http://mta-sts.amicilyricopera.com/uploads/1/3/0/6/130639444/likinasapop.pdf
    • http://tractortrailerrepairrichmond.com/uploads/1/3/0/7/130739169/kudukuri-vigige-nepixebamadita.pdf
    • http://preparetocare.net/uploads/1/3/0/6/130621038/nifave.pdf
    • http://rpluscreativesmy.com/uploads/1/3/0/5/130539672/6b4bd18d.pdf
    • http://forcke.com/uploads/1/3/0/5/130541065/032b458f99.pdf
    • http://realtypropertiesandinvestment.com/uploads/1/3/0/6/130620244/5178223.pdf
    • http://icycleni.com/uploads/1/3/0/9/130969682/zideme-fonore-disiruralefedaz-goxotilux.pdf
    • http://madder.store/uploads/1/3/0/5/130589037/40a024.pdf
    • http://legacytransportation-freightbrokerage.com/uploads/1/3/0/5/130588221/rexewew_mawexizewof.pdf
    • http://www.importanceofmarriage.org/uploads/1/3/0/6/130621000/5a0cac8723eebf.pdf
    • http://xinliyulekaihu.br3h.com/uploads/1/3/0/7/130740597/130740597.html#what+is+the+accrual+basis+accounting

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fe9.bin
7d1657a2217361f427a5f3e7ace8f57c2ff945f752f184f03726fe51d500daba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FE9 7452 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.