Malicious PDF — malware analysis report

Static analysis result for SHA-256 aa62a3792b4820a0…

MALICIOUS

PDF

44.8 KB Authoring application: Serif PagePlus
MD5: b59403000c9d1a5358c2b666d8595681 SHA-1: 4163f7eaae97199eb1122a64165c2a66abdcf4a1 SHA-256: aa62a3792b4820a0b395800f6635bbf6e27d95da285f03ea2ea06e790d6f17bf
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple heuristics, including a critical finding for a link farm and ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The presence of 31 external PDF links, primarily hosted on domains like 'vehda.com', strongly suggests a phishing or SEO manipulation campaign. No scripts were extracted, but the sheer volume of outbound links indicates a malicious intent to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vehda.com/uploads/1/3/0/4/130483937/dikegigapavetadi.pdf
    • http://hello-baby-toys.com/uploads/1/3/0/6/130604681/rebimefeja-zetumekoj.pdf
    • http://northstarcare.org/uploads/1/3/0/6/130639791/c435ea1.pdf
    • http://mail.richardhermanart.com/uploads/1/3/0/7/130775763/3599f0.pdf
    • http://thezedhotel.com/uploads/1/3/0/7/130738666/jurejonudobugoj-nisazubu.pdf
    • http://stephaniejacobs-sculptures.com/uploads/1/3/0/4/130476102/tajivotez-xurokok-farozebukekada-zedobelufezup.pdf
    • http://desertdreamxxx.com/uploads/1/3/0/6/130621361/70430da.pdf
    • http://thecabletvterminator.com/uploads/1/3/0/5/130551266/ruwowetip_lokixavokirix.pdf
    • http://villarrealenergy.com/uploads/1/3/0/5/130539072/f8c29d7c9f6.pdf
    • http://www.justmakemehappy.com/uploads/1/3/0/8/130813644/3653364.pdf
    • http://www.oklahomacity-appraisals.com/uploads/1/3/0/6/130603941/bb0d8ff6f8e.pdf
    • http://foxgrove.tech/uploads/1/3/0/5/130543386/bukewo.pdf
    • http://eftcon.com/uploads/1/3/0/6/130603982/kelesinur-wubetebupo-tilisegug-gizupedemakumi.pdf
    • http://drlyons.net/uploads/1/3/0/5/130590241/7240690.pdf
    • http://cectcapecod.com/uploads/1/3/0/7/130738511/lezogopaboku_batukezarigu.pdf
    • http://nextbillionventures.com/uploads/1/3/0/3/130313130/8766939.pdf
    • http://jansavagefiberarts.com/uploads/1/3/0/4/130483394/tunesaz_gilusovetasani.pdf
    • http://aikatysolutions.com/uploads/1/3/0/3/130313156/jugowevakajawiniliw.pdf
    • http://downsideupphoto.com/uploads/1/3/0/6/130639221/kufidufab_vivaloro_xatelapanipizes_kemadagugufop.pdf
    • http://kreativekidsworld.com/uploads/1/3/0/5/130540211/5f5c7c738c6e.pdf
    • http://markaymanagement.com/uploads/1/3/0/2/130271063/notinonekemuva.pdf
    • http://mcwhorter.family/uploads/1/3/0/8/130874520/9f6a96f7d2cec24.pdf
    • http://kkyulekaihu.br3h.com/uploads/1/3/0/8/130814062/130814062.html#can+adobe+distiller+convert+pdf+to+word
    • http://thezedhotel.com/uploads/1/3/0/7/130738666/jurejonudob

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004da5.bin
e6f74027951dd0f83f5ee5433603618051f46d3d2a696db8e2ab6ea82c3adf85		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4DA5 8004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.