PDF malware analysis — malicious · cc80739e2ca32ca2

MALICIOUS

PDF

39.2 KB Authoring application: SWFTools

MD5: 1289e41e3731bc14b99a93bcb425ced2 SHA-1: d375e3b566a97b2510966b25333440b807368497 SHA-256: cc80739e2ca32ca2b01e1c236a384e622776063426fbb53047e949f37361b1f1

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The primary indicator is the presence of a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. These links likely serve to redirect users to malicious content or to manipulate search engine results, a common tactic in phishing and SEO spam campaigns. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://mexonthemenu.com/uploads/1/3/0/6/130640208/bekaza.pdf
- http://drchristophersmith.net/uploads/1/3/0/2/130272932/belijar-tisupavut-dexuruniravuto.pdf
- http://mtdistrictlwml.com/uploads/1/3/0/6/130621844/kosixujolozerobi.pdf
- http://soulilluminations.com/uploads/1/3/0/6/130621591/xixakekitinoka_zopovozatobo.pdf
- http://cubriendocfl.net/uploads/1/3/0/3/130323341/20ebac4.pdf
- http://modafabrictreasure.co.uk/uploads/1/3/0/4/130476069/1590037.pdf
- http://kidskeepcharlestonclean.org/uploads/1/3/0/5/130543552/9912040.pdf
- http://connorcopelandcreative.com/uploads/1/3/0/6/130639304/kesuxez.pdf
- http://nelancasterhub.org/uploads/1/3/0/6/130621814/93fe05b8dde55.pdf
- http://worldheartsfairtrade.org/uploads/1/3/0/5/130541600/penefuvaruxufobe.pdf
- http://padlog.net/uploads/1/3/0/6/130604580/jepivowidaju-nigoruk-keralejitepi.pdf
- http://mk-aldrans.weebly.com/uploads/1/3/0/6/130639753/vunigezadus-masasijaxezef.pdf
- http://sepubedi.tabiat.ru/uploads/2020/01/29/6658115.pdf
- http://normaniclothing.com/uploads/1/3/0/6/130603887/rawaneralamavosate.pdf
- http://poolservicesarasota.com/uploads/1/3/0/5/130588724/e27639b2a04d.pdf
- http://nkydogwalkathon.weebly.com/uploads/1/3/0/2/130291803/3934804.pdf
- http://radicalartisticdesigns.com/uploads/1/3/0/5/130551008/xideroke.pdf
- http://bravohobby.com/uploads/1/3/0/5/130590477/voxop_luxefojumofo_supoxuxatolajev.pdf
- http://percorsidarte.com/uploads/1/3/0/5/130590478/buzevewemibolenaxef.pdf
- http://mstudioland.ru/uploads/2020/01/28/semadukizirunevedul.pdf
- http://dougstewartcircus.com/uploads/1/3/0/3/130379074/pesipenurodujepime.pdf
- http://themethodmeditation.com/uploads/1/3/0/6/130604335/xejutu.pdf
- http://familytravelsworld.com/uploads/1/3/0/6/130622005/c3e3ba23d374ab3.pdf
- http://lespetitesnatures.net/uploads/1/3/0/2/130274315/zijasoguguti.pdf
- http://mobiledesigntechnology.com/uploads/1/3/0/5/130543280/3f2e8b5815157f.pdf
- http://mymissblue.com/uploads/1/3/0/2/130289431/130289431.html#automatic+clicker+3.+1+3

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000017c7.bin` `57e1bc413ee7befdf23cfb1be87325a603d58cdf27535eddcb036d178025d507`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x17C7	7748 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.