Malicious PDF — malware analysis report

Static analysis result for SHA-256 07c1cebc056e0e71…

MALICIOUS

PDF

66.1 KB Authoring application: Nitro PDF
MD5: 7320a12fa9887cc1b53bba033eeb4959 SHA-1: 6f4a00c5764efa9c30114d695e48d829fc0a7088 SHA-256: 07c1cebc056e0e7184778d96d52332169fcf54c43476d598f77b0dd291b192bb
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics as malicious, specifically indicating an advance-fee scam lure and a link farm. The embedded URLs point to numerous other PDF files, suggesting a coordinated effort to direct users to potentially malicious content. The ClamAV detection and ML classifier further support the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://solfeggiohypnosis.com/uploads/1/3/0/6/130621903/mobitewumiromidileka.pdf
    • http://mybulletproofart.com/uploads/1/3/0/6/130620364/zosuwakobemuzu.pdf
    • http://keyautonj.com/uploads/1/3/0/4/130483376/8486901.pdf
    • http://r-ewolucje.com/uploads/1/3/0/7/130740187/3987116.pdf
    • http://redandrio.com/uploads/1/3/0/6/130620509/pimetotonizis.pdf
    • http://nadiaberyl.fr/uploads/1/3/0/6/130640219/9d5feacf8b51.pdf
    • http://lisascentralcoast.com/uploads/1/3/0/4/130483338/ruvaluluradotiwogo.pdf
    • http://gearsgears.com/uploads/1/3/0/6/130604061/6593087.pdf
    • http://knitvegan.com/uploads/1/3/0/3/130313378/wifejese.pdf
    • http://realmorrowpost.com/uploads/1/3/0/3/130313306/4167070.pdf
    • http://anteako.com/uploads/1/3/0/6/130621829/kadix_dudexale_sevebobaman.pdf
    • http://azseniorresourcesandmore.com/uploads/1/3/0/6/130603747/zomawatow.pdf
    • http://thehappygirlstore.com/uploads/1/3/0/5/130588724/130588724.html#categorical+data+analysis+using+sas+third+edition+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001390.bin
e58334aaa2ac1b15a8be9f32607a18e21e0fa485c68b19d5450c1ec6374fe979		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1390 8684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.