Malicious PDF — malware analysis report

Static analysis result for SHA-256 bbb817c23043ef77…

MALICIOUS

PDF

33.6 KB Authoring application: pstoedit
MD5: d865fa5b5362cbfa3fdbc9e33539876a SHA-1: 549e9ed40ef468017791e3fd6a193fa4be2a90f0 SHA-256: bbb817c23043ef779dacd756024c9dffe45be0830dd96864801b114acbbf5ebe
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, aligning with a phishing or content distribution attack pattern. No scripts were extracted, limiting the ability to determine specific payload delivery mechanisms.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://buildyourbrandfitness.com/uploads/1/3/0/6/130620401/xoleguwatoxadugo.pdf
    • http://qeisolutions.com/uploads/1/3/0/6/130620581/f20a64ced668.pdf
    • http://geekpursuits.org/uploads/1/3/0/2/130273980/6613953.pdf
    • http://northpugetsound.net/uploads/1/3/0/2/130289427/85b6247960187.pdf
    • http://hostmaster.martinezinsuranceagency.com/uploads/1/3/0/6/130604544/xorewuz_wilage_pekaremik.pdf
    • http://mkrishnan.org/uploads/1/3/0/7/130776504/zemun.pdf
    • http://nursingteas.com/uploads/1/3/0/5/130539223/kapixebuga-dakeboxerap.pdf
    • http://medios21.com/uploads/1/3/0/5/130588378/6315087.pdf
    • http://laurenaliceavery.com/uploads/1/3/0/2/130274269/cbc7e17.pdf
    • http://groer.xyz/uploads/1/3/0/5/130539899/208caee.pdf
    • http://neonopen.com/uploads/1/3/0/7/130739571/begipajab.pdf
    • http://adsl-63-204-18-24.benefitplans.org/uploads/1/3/0/6/130621684/130621684.html#diviser+document+pdf+en+ligne
    • http://nursingteas.com/uploads/1/3/0/5/130539223/kapixebuga-dakeboxerap

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ae2.bin
fe64009bcf5290a162db48d00e971f8b7d84300667d76d04fe0f2dfc421cdb03		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2AE2 9252 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.