Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ca338313931c788…

MALICIOUS

PDF

43.3 KB Authoring application: ImageMagick First seen: 2020-07-24
MD5: 441936ebb2924639d4925731832e79a0 SHA-1: ac913ad2953df9ea4452474ee33d5242fb94902e SHA-256: 0ca338313931c788a80bf3b5a0f26b0009ebd20a47b3487c95a5179f553bc48b
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded URLs, many of which appear to be part of a link farm designed for SEO manipulation. The heuristic 'SE_BROWSER_INSTALL_LURE' indicates the document likely prompts the user to install a browser extension or update, a common social-engineering tactic. ClamAV detection and ML classification further support its malicious nature, suggesting it's a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://videoglyph.org/uploads/1/3/0/8/130814594/nemelobodamud.pdf In PDF document text
    • http://anappleatdawn.com/uploads/1/3/0/6/130621058/26678af8.pdfIn PDF document text
    • http://www.victorianmanorhc.org/uploads/1/3/0/6/130605397/9173765.pdfIn PDF document text
    • http://ag-coin.com/uploads/1/3/0/7/130776096/bidibuwiten_kopitikojetije.pdfIn PDF document text
    • http://jodpt.com/uploads/1/3/0/9/130969249/madigapidom_fopiwox_sogego_pilukamabofof.pdfIn PDF document text
    • http://neighborhoodpage.com/uploads/1/3/0/8/130874347/falonejera.pdfIn PDF document text
    • http://glenrocksocial.com/uploads/1/3/0/2/130289478/ladepavademiwukikapo.pdfIn PDF document text
    • http://pensacolapetcommunity.com/uploads/1/3/0/7/130739188/nafafa.pdfIn PDF document text
    • http://freeshein.com/uploads/1/3/0/6/130639853/9e7193d7.pdfIn PDF document text
    • http://preparetocare.net/uploads/1/3/0/6/130621038/nifave.pdfIn PDF document text
    • http://juliaberry.org/uploads/1/3/0/5/130544147/629da34927e.pdfIn PDF document text
    • http://jamielyoung.com/uploads/1/3/0/7/130776324/130776324.html#the+official+comptia+project++study+guide+%28exam+pk0-004%29In PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005045.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5045 8840 bytes
SHA-256: 2b614b3dd788a3e5d429cc3af4a16ac4ae2c6526cbbf703755dd2f78aceb4823

Open this report in the interactive analyzer, or submit your own file for analysis.