Malicious PDF — malware analysis report

Static analysis result for SHA-256 0956dd168d5f25c7…

MALICIOUS

PDF

72.7 KB Authoring application: ImageMagick
MD5: 2d808b8729e4dcf2d283624dd0511233 SHA-1: 4a109cd0d1c2cc1f713cbdcb64a0e095bfe8dc2a SHA-256: 0956dd168d5f25c7597fafa64c5ab38eb9454d0c93eb8300d87049ab11963652
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document exhibits characteristics of a link farm, with numerous embedded URLs pointing to external PDF files, suggesting an attempt to manipulate search engine results or redirect users to potentially malicious content. Additionally, a callback phishing lure was detected, indicating a social engineering attempt to trick users into contacting a fraudulent entity. The ML classifier and ClamAV detection further support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9979

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://beingself-centered.com/uploads/1/3/0/4/130478163/xorebixirasexare.pdf
    • http://belladesgagnes.com/uploads/1/3/0/4/130488506/5904939.pdf
    • http://shotbyraquel.com/uploads/1/3/0/7/130776692/gebokenun.pdf
    • http://tatarstan.travel/uploads/2020/01/28/mixifa.pdf
    • http://worldgolflessons.com/uploads/1/3/0/5/130551386/fb955e867d.pdf
    • http://reboundat.com/uploads/1/3/0/5/130546717/130546717.html#rom+android+9+samsung+s7+edge
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • http://www.adobe.com/).Noto
    • http://www.google.com/get/noto/http://www.adobe.com/type/This
    • http://scripts.sil.org/OFLNoto

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011ed.bin
3a3233adeebd12a5ecdad5f06cec169d05c5ff946e699ccc1f7e9f9ac5ae75e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11ED 11080 bytes
font_01_sfnt_off0000c332.bin
ac0411223d7897d4eabe960fc8b799c02229bffeefb4b2825a080a9d7dee25d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC332 20780 bytes
font_02_sfnt_off0000de41.bin
83a65be61fd5f822c5bb952dc265a4175bff334d0de487e7b8cedc827af046f5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE41 4616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.