Malicious PDF — malware analysis report

Static analysis result for SHA-256 01d144edc154e014…

MALICIOUS

PDF

44.8 KB Authoring application: Inkscape
MD5: 518cfaad1faea4ca07ff79167c060adc SHA-1: 0d9c7c1883e985f954f052d83de966b201a742f0 SHA-256: 01d144edc154e014ce191dfe8ab07bb0df3b458aa818e2d7d0207792cd43540e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also indicate maliciousness, with ClamAV specifically identifying it as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body is heavily obfuscated and does not provide clear instructions, but the overall structure points to a link farm or SEO spam tactic designed to drive traffic to malicious or unwanted content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wishaloo.com/uploads/1/3/0/6/130639140/5d2ee307b1a.pdf
    • http://www.therhondawhitecollection.net/uploads/1/3/0/2/130288757/71316f3d91.pdf
    • http://dinastiy.com/uploads/1/3/0/3/130323186/dafaranigefekir.pdf
    • http://hostmaster.treatmentforcystitis.co.uk/uploads/1/3/0/6/130620687/48570207.pdf
    • http://ns1.carasoul.com/uploads/1/3/0/4/130490078/kexowom_gunesovuj_lufevup.pdf
    • http://www.yourpithytees.com/uploads/1/3/0/7/130775831/mepigo.pdf
    • http://www.nevacoboutique.com/uploads/1/3/0/4/130475997/kufipamova.pdf
    • http://plymouthroofingrepair.com/uploads/1/3/0/5/130550762/jatanapefaloz.pdf
    • http://pdfestatesltd.com/uploads/1/3/0/4/130476339/jazemolajoje_lokesugejebad_revomi_devuz.pdf
    • http://bluehawktrading.co.uk/uploads/1/3/0/4/130491932/zimuratelisotu-nakiwev.pdf
    • http://www.valkrieshopgoddess.com/uploads/1/3/0/7/130738512/tapudigofaz.pdf
    • http://bernardobellostudio.com/uploads/1/3/0/6/130640057/130640057.html#alarm+lock+trilogy+pdl6100
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000489c.bin
718fda967199f3f57f6c94eab6dcf0cc2282ca9bb54876b8da81b3bc0e3c4977		 pdf-font-stream PDF embedded font (sfnt) at offset 0x489C 3048 bytes
font_01_sfnt_off000055e9.bin
72238a5f99cd615b126e8383199bfee626cec5e638c3c997943ebfa3e80dca89		 pdf-font-stream PDF embedded font (sfnt) at offset 0x55E9 8884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.