Malicious PDF — malware analysis report

Static analysis result for SHA-256 8b1808d960b2ee60…

MALICIOUS

PDF

43.9 KB Authoring application: Pdftk
MD5: 06a4eb5e2852e8f5495dcc52ddc4b4df SHA-1: 6dadee40a82d0c27c757cc1c2eb6c109089f22a4 SHA-256: 8b1808d960b2ee609d2a0e0428309145c2008df22e7e70983b72f682334f97cf
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The PDF contains a large number of embedded URLs, suggesting it is part of a link farm or phishing campaign designed to redirect users to potentially harmful content. No scripts were extracted, and the document body was heavily obfuscated, preventing further analysis of specific user-facing lures.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://edsoncustomcruisers.com/uploads/1/3/0/4/130489143/senipenudibew_werisupo_poxuweg.pdf
    • http://midcoteaparty.com/uploads/1/3/0/7/130775676/8051655.pdf
    • http://eireneathens.com/uploads/1/3/0/6/130621141/gelubopodifadatob.pdf
    • http://saratogacornercafe.us/uploads/1/3/0/3/130312983/xazisi-nedipe-limulonug.pdf
    • http://resolvenetwork.net/uploads/1/3/0/6/130640142/sotibipuve.pdf
    • http://gramaudits.com/uploads/1/3/0/6/130621895/f6ded023548.pdf
    • http://141592.info/uploads/1/3/0/6/130639557/nawawidivaja.pdf
    • http://dematic-university.com/uploads/1/3/0/5/130590164/df2aa751.pdf
    • http://saudiexpats.org/uploads/1/3/0/4/130435702/851d16b9f9.pdf
    • http://unhappycamperstudios.com/uploads/1/3/0/2/130274076/7531879.pdf
    • http://mirrorsireland.com/uploads/1/3/0/2/130272291/1391332.pdf
    • http://skeletonsoutofthecloset.com/uploads/1/3/0/6/130621706/zemogaritev.pdf
    • http://intellidocs.net/uploads/1/3/0/2/130288962/gagonidowisuta.pdf
    • http://plexmediacenter.com/uploads/1/3/0/5/130551943/7090892.pdf
    • http://www.mossiepawspetmassage.com/uploads/1/3/0/7/130776808/8143423.pdf
    • http://onamishon.com/uploads/1/3/0/5/130546543/8081232.pdf
    • http://athome-atsea.com/uploads/1/3/0/5/130543074/nomuxizajofepudopig.pdf
    • http://canotekpark.com/uploads/1/3/0/7/130739626/4e639c59.pdf
    • http://adagedanceanddrama.com/uploads/1/3/0/6/130621786/5528217.pdf
    • http://webmail.t2troubleshooting.com/uploads/1/3/0/6/130620813/130620813.html#teacher+assistant+jobs+in+elementary+school

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000307b.bin
464aa4601eefaa431942c272c668fd61e07b6fd7f15391404bcd12b86f763033		 pdf-font-stream PDF embedded font (sfnt) at offset 0x307B 8004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.