Malicious PDF — malware analysis report

Static analysis result for SHA-256 bf2f835e4579a38f…

MALICIOUS

PDF

43.1 KB Authoring application: Soda PDF
MD5: 1547b87c0c5fd900b55be1181717bd5f SHA-1: ffbd0f19dc1d9d24a1932380f6c57703d41d7fac SHA-256: bf2f835e4579a38fb28ca9b2dfbf0e9cb056da9cd074d60887dfe7f0abedd5c5
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was detected as malicious by ClamAV and an ML classifier, and exhibits characteristics of a link farm with numerous embedded URLs. The heuristic 'PDF_SEO_LINK_FARM' indicates a high volume of external links, suggesting a phishing or malware distribution attempt. The document body contains garbled text and embedded URLs, further supporting the malicious intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bosenoji.weebly.com/uploads/1/3/0/4/130436402/4459996.pdf
    • http://myresortwear.net/uploads/1/3/0/2/130288720/20e1b313c.pdf
    • http://nicolemfraley.com/uploads/1/3/0/4/130483772/4843273.pdf
    • http://acikhatal.com/uploads/1/3/0/5/130590431/6479114.pdf
    • http://kindyogami.weebly.com/uploads/1/3/0/5/130551000/9671457.pdf
    • http://babyak.net/uploads/1/3/0/3/130379062/2712942.pdf
    • http://catalinapools.net/uploads/1/3/0/5/130539269/f0253078fc463.pdf
    • http://jackpassion.org/uploads/1/3/0/4/130435657/9208404.pdf
    • http://thinkingspot.com.au/uploads/1/3/0/5/130588936/liwofovuxiside_gabila_vimamupezikem.pdf
    • http://noahopper.com/uploads/1/3/0/5/130588210/zavimapevopa_lorigufe_niralak.pdf
    • http://adaircctv.com/uploads/1/3/0/4/130477613/63010a476.pdf
    • http://ritasoto.com/uploads/1/3/0/6/130639710/3d975e5d.pdf
    • http://advance-it.net/uploads/1/3/0/6/130604290/130604290.html#thousand+years+piano+guys+sheet+music

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012ef.bin
e4c1766f6f2c69cf1793909f1c21ca92acf3d9d2303f4b73e39082a770e0452f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12EF 9984 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.