Malicious PDF — malware analysis report

Static analysis result for SHA-256 adf006a280d4981c…

MALICIOUS

PDF

36.3 KB Authoring application: PDFedit
MD5: dfc1568c45ae84016736061c65f425ae SHA-1: 1801f94b13516a2f640c6d72434355431c6b590c SHA-256: adf006a280d4981c1636b52c60ebdb5972ef0ceffa191b3b040c022643a6abd1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The file was detected as malicious by ClamAV and an ML classifier, and exhibits a PDF SEO link farm heuristic. The document body contains numerous embedded URLs pointing to external PDF files, suggesting a phishing or SEO manipulation attempt. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wildblueservices.net/uploads/1/3/0/4/130488412/4687328.pdf
    • http://premierbv.com/uploads/1/3/0/4/130483376/28c10563717.pdf
    • http://photographartprints.com/uploads/1/3/0/6/130621952/91d8b9efe.pdf
    • http://thesocialweekly.com/uploads/1/3/0/6/130603954/ce102e6f523.pdf
    • http://ashmaclean.com/uploads/1/3/0/4/130476462/f797a.pdf
    • http://swappinghub.com/uploads/1/3/0/5/130538833/ce887af36396be.pdf
    • http://mr-castironcreations.com/uploads/1/3/0/4/130483320/tufakorexewideg.pdf
    • http://www.goldencircleent.com/uploads/1/3/0/5/130543682/5122464.pdf
    • http://paperawesome.net/uploads/1/3/0/5/130550813/gotefes-lufilib-xegixim-rolobozuk.pdf
    • http://abundantgracefellowship.org/uploads/1/3/0/5/130550869/df079230a5fe6c.pdf
    • http://mscalvin.com/uploads/1/3/0/6/130639121/kesade-wekewaribivofof-musipa-wuvet.pdf
    • http://lbadisasterrelief.com/uploads/1/3/0/3/130379741/kovurulem-gakuxutiw-bajukamezavor-baradazegub.pdf
    • http://dedicated-15.pleasingfood.com/uploads/1/3/0/5/130588572/130588572.html#maslow+self+actualization+stage

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000038f5.bin
03a9b51914692e23673181275005bb7162eed2167c047f7dbf468a84b7d19796		 pdf-font-stream PDF embedded font (sfnt) at offset 0x38F5 6876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.