Malicious PDF — malware analysis report

Static analysis result for SHA-256 0437164facf36fac…

MALICIOUS

PDF

31.9 KB Authoring application: ImageMagick
MD5: 0eba7a385d6e017094191beb0288232f SHA-1: 441202dfc9643f99e8dedd884653f43bfd1145d8 SHA-256: 0437164facf36fac03cb04deb6edb55e77d36f51a0f9a7c83abe45878dc454ae
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0. The document contains a large number of embedded URLs pointing to other PDF files, suggesting a link farm or a distribution mechanism for further malicious content. The SE_CALLBACK_LURE heuristic indicates a potential phishing or scam pretext, although the document body itself is heavily obfuscated and does not provide clear textual lures.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://consplayers.com/uploads/1/3/0/7/130776520/zanuzesisode.pdf
    • http://moggiethecat.com/uploads/1/3/0/4/130483866/8390840.pdf
    • http://judygumboalbert.com/uploads/1/3/0/6/130604815/42435e.pdf
    • http://www.elenadaniele.com/uploads/1/3/0/7/130738719/jefanejefogixefivuvi.pdf
    • http://bostonchaptermerch.com/uploads/1/3/0/6/130620380/tasajiwoxegago.pdf
    • http://7-niebo.com/uploads/1/3/0/6/130621032/4676695.pdf
    • http://simscambodia.com/uploads/1/3/0/7/130740265/3252328.pdf
    • http://russelljburns.com/uploads/1/3/0/4/130489122/vumojelex.pdf
    • http://abject-adventures.com/uploads/1/3/0/3/130379239/2923289.pdf
    • http://stratelega.com/uploads/1/3/0/8/130814235/xifigekomosoworut.pdf
    • http://mail.growingrootsinpresence.com/uploads/1/3/0/7/130776162/3e69b.pdf
    • http://summit2summitcoaching.com/uploads/1/3/0/8/130874219/bujevenuvika-xosejutelozo.pdf
    • http://blockchainbetterbusiness.com/uploads/1/3/0/7/130775737/fuvenumileb_sajezu_xaduluba_zazudadada.pdf
    • http://bestfreebetoffers.uk/uploads/1/3/0/6/130604973/6769258.pdf
    • http://pickmypooltable.com/uploads/1/3/0/6/130605442/6554540.pdf
    • http://lavanderiaspadiniromacentro.com/uploads/1/3/0/6/130604737/lomip-wubiweg-vufufujud.pdf
    • http://webdisk.carolinecranshaw.com/uploads/1/3/0/4/130435839/1793460.pdf
    • http://figga.com/uploads/1/3/0/4/130435892/043c0292.pdf
    • http://neokundalini.org/uploads/1/3/0/5/130539215/130539215.html#sears+craftsman+10+radial+arm+saw+model+113

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001f82.bin
604455ebe110442e8aed4ac79f70e4000be5fcf8214b864ab63dbfc74f07fc7e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1F82 7496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.