Malicious PDF — malware analysis report

Static analysis result for SHA-256 a29dfe0a27f5344c…

MALICIOUS

PDF

38.1 KB Authoring application: Smallpdf Desktop
MD5: dd6748ec3a0a8caa2f31484d39ab198a SHA-1: 7969d0462e9ce498d2717e100b2a8f4b9c07c7dd SHA-256: a29dfe0a27f5344c31ddc63889070a2c615cb308602ef5660bfe68590572b1a5
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The primary attack pattern observed is a 'PDF_SEO_LINK_FARM' heuristic, which identifies a large number of embedded external links. These links, predominantly pointing to other PDF files hosted on various domains, suggest a distribution or redirection mechanism, possibly for phishing or malware delivery. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://winestains.net/uploads/1/3/0/7/130739561/1934688.pdf
    • http://mtnsupply.net/uploads/1/3/0/8/130814390/voxuwekakivuwe_kifodusarab_vaxafufasox.pdf
    • http://losangelesmural.org/uploads/1/3/0/6/130639995/jolofuvivami-kalud.pdf
    • http://concretecuttingloganut.com/uploads/1/3/0/6/130621068/wusexejofe_lamumowalarome_xijukitosotas_gobara.pdf
    • http://feetforfish.com/uploads/1/3/0/4/130435743/2407fa.pdf
    • http://nolarestorations.com/uploads/1/3/0/5/130539004/ragevakaxuxu-wiluwotezinin-laraxebew-zotizapupogu.pdf
    • http://www.brunchbikesandbeer.com/uploads/1/3/0/5/130551011/waxelipumolobuw.pdf
    • http://dianakingsley.us/uploads/1/3/0/6/130605069/dovusanur.pdf
    • http://annesketch.com/uploads/1/3/0/4/130476102/sisomefevajapofupoti.pdf
    • http://stevewarren.us/uploads/1/3/0/2/130272336/pidojomu-xobapejinol.pdf
    • http://ganbeiliquor.com/uploads/1/3/0/4/130489499/4c020e07a.pdf
    • http://kassimusic.com/uploads/1/3/0/5/130589090/bidabew.pdf
    • http://www.benjibutton.com/uploads/1/3/0/4/130476454/majemebiwimes-rarekaxibarup-vimurezudog.pdf
    • http://earthangeledibles.com/uploads/1/3/0/7/130776300/3709761.pdf
    • http://blogpostcontent.com/uploads/1/3/0/8/130874522/5907827.pdf
    • http://www.planteriget.com/uploads/1/3/0/3/130323158/wawiniguzetufavu.pdf
    • http://www.lifecosmetics.shop/uploads/1/3/0/2/130289613/c416f678977eb3a.pdf
    • http://myabishai.net/uploads/1/3/0/5/130543868/vuxegasamoriroluwimu.pdf
    • http://tmctouch.tech/uploads/1/3/0/6/130639273/4258620.pdf
    • http://mothermoxie.com/uploads/1/3/0/4/130489423/sajurowagumet.pdf
    • http://www.alvarezorganics.com/uploads/1/3/0/4/130435794/6875971.pdf
    • http://w6jsx.bpmtc.com/uploads/1/3/0/2/130272070/130272070.html#adobe+acrobat+pro+dc+edit+text
    • http://www.planteriget.com/uploa

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003486.bin
43da7d4813ebe7e117a75a23598ede34e6e95e9007711f4ebfe258a4b6d36329		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3486 7784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.