Malicious PDF — malware analysis report

Static analysis result for SHA-256 f72a157f4b489e5d…

MALICIOUS

PDF

39.9 KB Authoring application: Smallpdf Desktop
MD5: c617b8706159d060b6d9a99d03f9ef18 SHA-1: d679277c7e75161f1f7fdfd5c0f53a9eb994af3a SHA-256: f72a157f4b489e5d2ce25c577447a493ebff3dacb176e7b4d37103d4fcb42c97
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

This PDF file was flagged by multiple heuristics, including ClamAV and a machine learning classifier, as malicious phishing content. The primary attack pattern involves a link farm directing users to numerous external PDF files. The embedded URLs suggest a tactic to inflate search engine rankings or distribute further malicious payloads. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mommyandbeeboutique.com/uploads/1/3/0/6/130621524/901dbf69c8de48.pdf
    • http://mibias.net/uploads/1/3/0/6/130621083/91067688ca3e.pdf
    • http://nmsapa.com/uploads/1/3/0/6/130604259/dowevalafesivin.pdf
    • http://myruffledskirts.com/uploads/1/3/0/7/130739662/wovesutosobuma_lamudotu.pdf
    • http://privetst.com/uploads/1/3/0/3/130379379/d5dfe24d9.pdf
    • http://rockingwithpurpose.com/uploads/1/3/0/6/130605338/9326795.pdf
    • http://newenglandgoodlife.net/uploads/1/3/0/4/130475955/fusedates.pdf
    • http://619756869709789420.com/uploads/1/3/0/5/130588221/lavugepi_bufakomixotezim_buvuzubadewi_nodugexuju.pdf
    • http://webdisk.phleb.ca/uploads/1/3/0/5/130539825/5661620.pdf
    • http://sgchoir.nl/uploads/1/3/0/4/130488195/sovotu-kuribax-vigix.pdf
    • http://residencebourgjoli.com/uploads/1/3/0/8/130813314/fediraka-limekal-pibetumadipizum.pdf
    • http://themodestcollection.com/uploads/1/3/0/2/130289797/lowomamesujunuj.pdf
    • http://www.olathekschiropractor.com/uploads/1/3/0/6/130604049/zodinupane-fakomuxajuteze-xapiluko-nebixubopi.pdf
    • http://cpanel.jacquelineclewis.com/uploads/1/3/0/6/130621385/130621385.html#html+to+pdf+c

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004108.bin
cff19b3523c95a302284a5f1611e6e34a0cf418eb895eef09731aeb52da80bd2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4108 8764 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.