Malicious PDF — malware analysis report

Static analysis result for SHA-256 abd3764de92f59d9…

MALICIOUS

PDF

38.0 KB Authoring application: PDF Studio
MD5: 2387ce319e197587bd737793165453d3 SHA-1: 710365e3fdae69926618a5ce94856a330396d4b7 SHA-256: abd3764de92f59d9598642d02b91135de3a68b0ec44a815be09c27b1972c6f9d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The critical PDF_SEO_LINK_FARM heuristic indicates the presence of a large number of external links, with the primary domain being pfopnodak.com. These links likely serve to redirect users to malicious content or phishing sites. The document body contains garbled text and a mention of 'gastric cancer causes', which may be a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pfopnodak.com/uploads/1/3/0/3/130313190/temorab-mudajoxapovu.pdf
    • http://ovospitanii.site/uploads/1/3/0/6/130605302/8195407.pdf
    • http://chaletalpemassif.com/uploads/1/3/0/8/130814681/wikizakeluremanu.pdf
    • http://solerconsulting.com/uploads/1/3/0/7/130740110/622deb9b.pdf
    • http://fanzines.net/uploads/1/3/0/8/130813055/zufibebijot.pdf
    • http://adrisbeautystudio.com/uploads/1/3/0/6/130605065/xemuzelop_xolexujugufi.pdf
    • http://openskydigitalmarketing.com/uploads/1/3/0/8/130813834/77e4982a10b1.pdf
    • http://futurely.org/uploads/1/3/0/8/130814237/639fe3ee51fa1.pdf
    • http://www.marjorielyngray.com/uploads/1/3/0/2/130288329/tubovaladorosibomozu.pdf
    • http://momentumlifecoach.org/uploads/1/3/0/7/130776393/e643945e.pdf
    • http://nfcfleonardville.com/uploads/1/3/0/4/130483862/kipoxofibibi_piwejove_nokadularefom_kebemasenosad.pdf
    • http://ivjournal.com/uploads/1/3/0/2/130289692/c7129e5c80bf8fc.pdf
    • http://whatdoyousee.art/uploads/1/3/0/7/130775818/purodezemus.pdf
    • http://mezalejandro.com/uploads/1/3/0/5/130550983/6a278.pdf
    • http://www.meganmann55.com/uploads/1/3/0/3/130323624/mokolin.pdf
    • http://nakitahogans.com/uploads/1/3/0/2/130292148/1380264.pdf
    • http://styleanddezineboutique.net/uploads/1/3/0/4/130488416/difikovirozesofa.pdf
    • http://suitsforteens.org/uploads/1/3/0/6/130604935/safajoler-pixepos-fejukizezen.pdf
    • http://ilovefatjack.net/uploads/1/3/0/6/130639622/6850928.pdf
    • http://bnichicago.org/uploads/1/3/0/5/130539842/kazidotudisa-zaxubevujok-rabawela.pdf
    • http://iweargreatness.com/uploads/1/3/0/8/130874060/130874060.html#cancer+gastrico+causas

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003534.bin
3d2a506c3e1fe846e9e6b69794e35807bcf7d495ce350f1825b15409486620bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3534 8348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.