Malicious PDF — malware analysis report

Static analysis result for SHA-256 835699efd15c3b39…

MALICIOUS

PDF

39.2 KB Authoring application: PDF Studio
MD5: cba14b3060790b42c531ba827ad97a51 SHA-1: 361171a3409dc2ba03864abc0a85820c0760faf0 SHA-256: 835699efd15c3b39081b66fa50d74b1bd99a6c26b13a5f1aa849cb91fd0292ee
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected as malicious by ClamAV and a machine learning classifier. The primary heuristic indicates a 'PDF_SEO_LINK_FARM' with 31 embedded external PDF links. These links likely serve as a lure to direct users to malicious content, consistent with phishing or malware distribution campaigns. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mynormanrockwell.org/uploads/1/3/0/7/130738764/7103367.pdf
    • http://weedeaterridinglawnmower.net/uploads/1/3/0/5/130588931/lujivekupome_rojajo_dajadesasa_buniwe.pdf
    • http://serbaballet.com/uploads/1/3/0/5/130589308/3889883.pdf
    • http://clevelandtoybox.com/uploads/1/3/0/6/130620491/18be394.pdf
    • http://a100radio.com/uploads/1/3/0/7/130776458/3d8b8b7.pdf
    • http://www.lindonsamgroup.com/uploads/1/3/0/3/130323979/teboximisuregonuni.pdf
    • http://nationalcasinomarketing.com/uploads/1/3/0/2/130289305/xukote_povegineviv_latedabudadakit.pdf
    • http://www.wigandweavehair.com/uploads/1/3/0/2/130289319/tagez_remebeduba_gasanuja.pdf
    • http://laudatemariam.com/uploads/1/3/0/6/130605030/nopetasejonumujerezu.pdf
    • http://kraimgroup.com/uploads/1/3/0/5/130550749/5025690.pdf
    • http://www.dannorrisdesigns.com/uploads/1/3/0/4/130483492/majame.pdf
    • http://proplacementsza.com/uploads/1/3/0/4/130483679/4364ebfc6654.pdf
    • http://mafamillecenla.net/uploads/1/3/0/5/130546519/bajuwagiti.pdf
    • http://beyondhillco.com/uploads/1/3/0/2/130289458/fazepidiladugiwufiji.pdf
    • http://mold-a-rama.net/uploads/1/3/0/2/130272610/vebulegokaxak-sireditele-wusixan.pdf
    • http://flykingzcollection.com/uploads/1/3/0/7/130738512/dufufi-losaxelalum-jerujevofof-kaketugobutukid.pdf
    • http://absoluteventoparty.com/uploads/1/3/0/5/130541817/lunegilazexikolujixo.pdf
    • http://newcovenantinspections.com/uploads/1/3/0/7/130776241/dinigezusosobu-kedetiwapul.pdf
    • http://thel14.com/uploads/1/3/0/5/130590059/gegupotul.pdf
    • http://bananacovers.com/uploads/1/3/0/6/130604176/810790.pdf
    • http://buffalobubbletea.com/uploads/1/3/0/7/130738641/0aa1a.pdf
    • http://laknaholdings.net/uploads/1/3/0/5/130588396/rifikubuso_babumebi_molofisikisa.pdf
    • http://wileybrands.com/uploads/1/3/0/8/130874220/1584304.pdf
    • http://down-the-block.com/uploads/1/3/0/7/130739126/7857006.pdf
    • http://karmoinmobiliaria.com/uploads/1/3/0/2/130287538/4591742.pdf
    • http://hemphealthapothecary.com/uploads/1/3/0/7/130740213/130740213.html#phosphate+buffered+saline+preparation+ph+7.4

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000344a.bin
8537416351ae5e115d28aaaa0491f78c152d80c2795d4194b4a874add40b680c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x344A 7952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.