Malicious PDF — malware analysis report

Static analysis result for SHA-256 dc7d358945330a7c…

MALICIOUS

PDF

40.1 KB Authoring application: Pdftk
MD5: b10e42ad052e0453e6dd9fd2a9928b24 SHA-1: 852718ba036a3bfeb89ffc9aa0473033414804f0 SHA-256: dc7d358945330a7c2038bb5864c68dc5d5fb3af9f510bb3b53b9c2bb7492ba07
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical finding for a link farm containing numerous external PDF links. The ML classifier also assigned a high probability of maliciousness. The embedded URLs suggest a phishing or malware distribution campaign, likely aiming to redirect users to compromised or malicious sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://teshenaturals.com/uploads/1/3/0/5/130588529/079c938490ae.pdf
    • http://strymoon.com/uploads/1/3/0/5/130550708/xekunokobesarel.pdf
    • http://findstlr.com/uploads/1/3/0/6/130604523/6566280.pdf
    • http://mrsbyars.com/uploads/1/3/0/7/130739578/tupafuzonoma.pdf
    • http://bisconsulting.it/uploads/1/3/0/8/130874439/597a506.pdf
    • http://diversityaccesspipeline.com/uploads/1/3/0/2/130272295/jovevegorog_folurudivusopa_xuzorok_rijijuje.pdf
    • http://boutiquenanamoda.com/uploads/1/3/0/5/130550929/2c2d3a8a.pdf
    • http://usvisahelper.com/uploads/1/3/0/7/130775386/xiruwosedazisifa.pdf
    • http://www.southernstylestudioandmore.com/uploads/1/3/0/5/130588954/mofobabojukumuxina.pdf
    • http://loyaltyconstructionstl.com/uploads/1/3/0/6/130639479/zulisifiba.pdf
    • http://saratogacornercafe.us/uploads/1/3/0/6/130639972/guxaxegiteruwa_kezekogikotun.pdf
    • http://beenbode.cash/uploads/1/3/0/3/130323337/vazati.pdf
    • http://thelyonstale.com/uploads/1/3/0/4/130479044/8a6aff84ea2.pdf
    • http://acellection.com/uploads/1/3/0/6/130621947/vivodudevod.pdf
    • http://zelt1.bpmtc.com/uploads/1/3/0/7/130775813/130775813.html#age+of+empires+3+++expanciones+the+warchiefs+-+the+asian+dynasties
    • http://diversityaccesspipeline.com/uploads/1/3/0/2/130272295/jovevegorog_folurudivusopa_xuzorok_rijijuje.p

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004334.bin
27ffde1daa1a14130cc212ef2ec5d00824a42816747799c00de18cf5697c2712		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4334 7868 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.