Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7586f734c377414…

MALICIOUS

PDF

41.7 KB Authoring application: Serif PagePlus
MD5: a8d8e3bc348cb095091b8220be08dbb6 SHA-1: 0338801be2013243a59b5d5526bda1e3e5de5d3d SHA-256: e7586f734c377414af3a06cd845a15f59faf89bbd35b286e11e4a1510e7fdf1b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files across various domains, indicating a link farm or distribution network. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution. No scripts were extracted, limiting the analysis of specific execution behaviors.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mistresswidow.com/uploads/1/3/0/7/130775780/4335785.pdf
    • http://mingocarelabs.com/uploads/1/3/0/6/130620293/zamewujubagujasig.pdf
    • http://jeffreyvictor.net/uploads/1/3/0/2/130289745/4494266.pdf
    • http://eumid.com/uploads/1/3/0/4/130489830/soxafufogaxapaxaj.pdf
    • http://becomeamedicareagent.com/uploads/1/3/0/8/130813301/kamoditagilajuz_debonizigiba.pdf
    • http://nailsbyrose.nl/uploads/1/3/0/5/130590443/wimatemekas.pdf
    • http://arbucklelakehomes.com/uploads/1/3/0/5/130590295/bemunujejezok_miwokakig_vusavubumugiji_bolujogepaxuzi.pdf
    • http://wbcobb.net/uploads/1/3/0/8/130873961/sexefopajan.pdf
    • http://lattaconsultants.com/uploads/1/3/0/4/130476089/bowefukebadobebaza.pdf
    • http://talltowergames.com/uploads/1/3/0/6/130620389/wesitujagixor.pdf
    • http://beseecherllc.com/uploads/1/3/0/6/130639580/f9e1d097a564410.pdf
    • http://amiciasamenities.com/uploads/1/3/0/7/130776740/4a1df1735b171.pdf
    • http://ngundua.info/uploads/1/3/0/5/130546803/0f6e0c5.pdf
    • http://whatthepottersdo.online/uploads/1/3/0/6/130621193/7388698.pdf
    • http://myrawilliamsottewell.com/uploads/1/3/0/7/130775422/6150060.pdf
    • http://shapnas.com/uploads/1/3/0/5/130588443/35411bb11c.pdf
    • http://retrofitmetalroofing.com/uploads/1/3/0/7/130739661/1742352.pdf
    • http://textilespreserved.com/uploads/1/3/0/2/130289240/morutedexefozo.pdf
    • http://evilpiggie.com/uploads/1/3/0/4/130475973/3288205.pdf
    • http://guessproducts.com/uploads/1/3/0/5/130543057/zokuzit.pdf
    • http://wrcustomguitars.net/uploads/1/3/0/6/130621351/zisigosugigata_gozow.pdf
    • http://walleywag.com/uploads/1/3/0/5/130540009/175e554b5.pdf
    • http://mymissblue.com/uploads/1/3/0/5/130539092/130539092.html#adobe+acrobat+pdf+creator+free+download+full+version
    • http://becomeamedicareagent.com/uploads/1/3/0/8

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004051.bin
cf409f3f53fae5f979f068cd7944d3e60f58f260739828469d74ffdd583476c2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4051 8412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.