Malicious PDF — malware analysis report

Static analysis result for SHA-256 c97aadeaf248ad4b…

MALICIOUS

PDF

40.1 KB Authoring application: Serif PagePlus
MD5: ab4fbee9528d8dafaf5465f3d983e1a9 SHA-1: 4328328ea3ce90711532ec3062a8bb9a9c201208 SHA-256: c97aadeaf248ad4bd535d3b4c2303270ef46707fcf27fb37562608ba2b4ef4b1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple critical heuristics, including ClamAV and a machine learning classifier, indicating malicious intent. The document body, though partially corrupted, contains references to a 'Robinhood alto rangehood manual' and embeds multiple URLs. These URLs likely lead to further malicious content or phishing sites, consistent with a lure for downloading malware or engaging in phishing. The PDF_SEO_LINK_FARM heuristic specifically points to a large number of external PDF links, suggesting a link farm used for SEO poisoning or distributing malicious files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://balancedforlifeyogatherapy.com/uploads/1/3/0/2/130272394/5012826.pdf
    • http://templebnaiisraelnatchez.org/uploads/1/3/0/5/130544240/dugefidakivofilaxuvi.pdf
    • http://mmafanvote.com/uploads/1/3/0/5/130551487/3681504.pdf
    • http://insideosuokc.net/uploads/1/3/0/2/130289625/janivozuduzema.pdf
    • http://trentriverdesigns.com/uploads/1/3/0/2/130288341/130288341.html#robinhood+alto+rangehood+manual

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001099.bin
0fb5ce1619b9808bdc15dae8aa12f614f7c2c5654d3282adff0146cd94858bc4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1099 9332 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.