Malicious PDF — malware analysis report

Static analysis result for SHA-256 b11d1cb894817d1a…

MALICIOUS

PDF

41.9 KB Authoring application: Smallpdf Desktop
MD5: f38f553015c56e05dc7fba04245efba3 SHA-1: 6f8e494bc51b2c521df56d300bc643860e420387 SHA-256: b11d1cb894817d1a18fbb5c09a5e90074e9b698495e97a9df53acfd6d3897b9c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier strongly indicate maliciousness, with the embedded URLs likely serving as a distribution mechanism for further malware or phishing content. The document body, though partially corrupted, contains text related to medical conditions, potentially serving as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mikalivingstonart.com/uploads/1/3/0/8/130874250/befasagumanum.pdf
    • http://know-ing.com/uploads/1/3/0/6/130620574/tosuzisamivo.pdf
    • http://ligueusa.net/uploads/1/3/0/6/130621781/mazinijawo_tisoka_didikis_fatetafori.pdf
    • http://mfindia.org/uploads/1/3/0/8/130815277/fad2d0.pdf
    • http://faithful32x32.com/uploads/1/3/0/7/130740141/9284446.pdf
    • http://advocatesforanimalswnc.org/uploads/1/3/0/6/130620887/xesoziguw-fugomusimitub.pdf
    • http://www.barrybbritton.com/uploads/1/3/0/6/130639960/3159a5e60ade5.pdf
    • http://petsplayfull.com/uploads/1/3/0/6/130639160/7868805.pdf
    • http://peter-sand.net/uploads/1/3/0/4/130483402/8709ae.pdf
    • http://sofritospice.com/uploads/1/3/0/6/130621786/wiked-vigimikenegeke.pdf
    • http://www.zoeqjamesdesigns.com/uploads/1/3/0/5/130588548/sezor.pdf
    • http://allthings-change.com/uploads/1/3/0/7/130739952/2fb393bd.pdf
    • http://nylsremodelingcorp.net/uploads/1/3/0/6/130639721/denejogajetep.pdf
    • http://quorumpro.com/uploads/1/3/0/6/130604636/pivofuzajof-zebosegilupi-fibikamegozev-gometip.pdf
    • http://mytwobreastfriends.net/uploads/1/3/0/5/130539797/83c00e2.pdf
    • http://thecrystalheart.shop/uploads/1/3/0/7/130775605/132a3bc7c0.pdf
    • http://acceleratecleaning.com/uploads/1/3/0/2/130272233/jexokamup.pdf
    • http://alloexo.org/uploads/1/3/0/5/130539837/a50ad51.pdf
    • http://hostmaster.walknowtracks.co.uk/uploads/1/3/0/4/130489523/zonofukuxo.pdf
    • http://porttownpros.com/uploads/1/3/0/4/130476541/tatoxafiz-xevigo.pdf
    • http://sq9o4.salon225.com/uploads/1/3/0/3/130379351/130379351.html#management+of+acute+peptic+ulcer+disease

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000043e1.bin
02001a27d02af33193ce4926495f7a7870b91064e2f8cd2c12d59a212fee3fd3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x43E1 8364 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.