Malicious PDF — malware analysis report

Static analysis result for SHA-256 f7ef00c6b163b9d3…

MALICIOUS

PDF

41.6 KB Authoring application: Pdftk
MD5: af30020862d8fd8b5de6ff250f9e6d0b SHA-1: d1ca1e9ffbea0d0ea7641cd7e07794bd06ad9095 SHA-256: f7ef00c6b163b9d3ab5a66049cf4f64e90e02036e83b96d24f116e717f77754e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF documents. This behavior is indicative of a link farm, likely used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, aligning with the PDF_SEO_LINK_FARM heuristic.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mytexanlife.com/uploads/1/3/0/3/130379928/kisonozi-kolabuwitu-vurupapufexi.pdf
    • http://positivelygroovy.net/uploads/1/3/0/5/130588394/kasenadugitok.pdf
    • http://camryncs.com/uploads/1/3/0/5/130539728/xeposu_jigoxem_zukoguwi_wipip.pdf
    • http://lane8gamingstudio.com/uploads/1/3/0/6/130605174/9f2ae.pdf
    • http://mwvrc.org/uploads/1/3/0/3/130313700/f4630d.pdf
    • http://saculled.store/uploads/1/3/0/5/130539099/0b2b3.pdf
    • http://bcssummerlanguagecamp.com/uploads/1/3/0/3/130323724/megesolepijalapifola.pdf
    • http://lagniappewithahook.com/uploads/1/3/0/4/130478663/komanigigozox.pdf
    • http://mytridentestates.com/uploads/1/3/0/6/130605217/lotuwakabeko_waxegowiwakiru_giwopig.pdf
    • http://bananacovers.com/uploads/1/3/0/6/130620986/fejomanarijudu_kovinox_sipawiwexu_miwajatirogukeg.pdf
    • http://misssoutheastpageantry.us/uploads/1/3/0/5/130545753/130545753.html#non+essential+amino+acids+for+poultry

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012d9.bin
3b2b73f908c49697bb7be8b6448d44cdf388915c5f515af00289c8a8d7c8878c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12D9 8472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.