Malicious PDF — malware analysis report

Static analysis result for SHA-256 0fbe110abb84e7a3…

MALICIOUS

PDF

30.9 KB Authoring application: GIMP
MD5: 0997dda9c5d73f6de763181b0970a144 SHA-1: 191679db9c251876c870c1c33db9a50ca371a939 SHA-256: 0fbe110abb84e7a3323340af8cb8d4fee8e6542aa7b71af402bbe3b42b929d49
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by multiple heuristics and a machine learning classifier. It contains a large number of embedded URLs pointing to other PDF files, suggesting a link farm or redirection scheme. The document body also contains invoice-related text, indicating a potential lure to encourage user interaction with the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mytrucutz.com/uploads/1/3/0/2/130272918/86954f.pdf
    • http://nutritionbylaurann.com/uploads/1/3/0/3/130323632/80b06b1da6d.pdf
    • http://crystalcoastkidz.com/uploads/1/3/0/7/130740298/dufunaxinew-miwuwevamarozut-nuzomabosa.pdf
    • http://hollandfotovideo.com/uploads/1/3/0/6/130620972/woris_dinogigefito_zejotusonuzem_kerel.pdf
    • http://adsgoround.com/uploads/1/3/0/5/130539185/1494566.pdf
    • http://mta-sts.mail.stmarksdalton.org/uploads/1/3/0/8/130813094/purobizode.pdf
    • http://advancedinstallations.com/uploads/1/3/0/7/130775506/1662770.pdf
    • http://www.oldechucatown.com/uploads/1/3/0/2/130289524/suxoboz.pdf
    • http://eaganartistconnect.org/uploads/1/3/0/4/130436494/gepam_vegazizeduxeje.pdf
    • http://www.alicesenrichmentcenter.com/uploads/1/3/0/7/130775751/04ae17736.pdf
    • http://clintonstudio54.com/uploads/1/3/0/5/130540642/cf9edb.pdf
    • http://coveinnonnaplesbay.com/uploads/1/3/0/6/130639304/d9544d.pdf
    • http://offthepier.net/uploads/1/3/0/7/130739480/bezefu-nuzowasilul-mogoligerisapur-gamuvobuva.pdf
    • http://tech-trend-style.com/uploads/1/3/0/4/130483364/vewibaxipowiroma.pdf
    • http://fonestalve.com/uploads/1/3/0/8/130814081/nivituburodibom.pdf
    • http://www.truebestself.com/uploads/1/3/0/7/130776222/130776222.html#state+bank+of+india+account+opening+form+2019

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001e0b.bin
6e215e0a32c34c85550b987b0f2c4aee3632a7f497293401451cee4ee1e19023		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1E0B 7548 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.