PDF malware analysis — malicious · 11aadac01e616980

MALICIOUS

PDF

43.4 KB Authoring application: ImageMagick

MD5: f98318366120f9c7f5d148d174e40a57 SHA-1: 90e4b81aefa5e6f304b5a0d8649382e81cb23a8a SHA-256: 11aadac01e616980f08c1cc4005fd9af1f53ae3d39db1bd5eca32755fa41c764

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to malicious sites. ClamAV detected this file as Pdf.Phishing.TtraffRobotInstall, indicating a phishing or traffic redirection purpose. The ML classifier also strongly flagged this PDF as malicious.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://hilaryrichardson.com/uploads/1/3/0/3/130323588/9af599241076.pdf
- http://www.rynesfamily.com/uploads/1/3/0/7/130775376/zuxajujili.pdf
- http://magick-mart.com/uploads/1/3/0/4/130483454/4be36c6d8736ce.pdf
- http://ooredoooman.net/uploads/1/3/0/3/130313075/zujaj.pdf
- http://lilyfairjewellry.com/uploads/1/3/0/7/130740141/dbe4cd33c.pdf
- http://blythetierneydever.com/uploads/1/3/0/7/130775009/6d1e5bfe047.pdf
- http://sachianimalrescue.com/uploads/1/3/0/4/130488229/1034a65809.pdf
- http://myjourneyracing.com/uploads/1/3/0/5/130551351/c52a528d62.pdf
- http://annemarieguarnieri.com/uploads/1/3/0/5/130544938/nazagexaribobi.pdf
- http://card-on-blue.com/uploads/1/3/0/7/130776260/b09d1.pdf
- http://nateandamy.com/uploads/1/3/0/7/130776027/nuvitopedasefan-rejokuz-fozaguwe-xigobegutu.pdf
- http://addieprayse.com/uploads/1/3/0/2/130289189/xowubip_fonaxonamidimef_mekatotutan.pdf
- http://www.ulysbefesa.com/uploads/1/3/0/6/130640114/vodokejirusos.pdf
- http://kheeterwgu.com/uploads/1/3/0/2/130270985/vimubupitidi.pdf
- http://mustardgreen.net/uploads/1/3/0/8/130813448/7034431.pdf
- http://splashcactus.com/uploads/1/3/0/2/130289225/48715611fbb54.pdf
- http://florecercasitas.com/uploads/1/3/0/7/130775818/9108504.pdf
- http://www.walkeredisonfurniture.org/uploads/1/3/0/7/130739142/lodavebebune-takonaguxisez.pdf
- http://scrambledtosunnysideup.com/uploads/1/3/0/4/130475938/gowepofafulig.pdf
- http://bethinkcreate.com/uploads/1/3/0/7/130738948/833a52.pdf
- http://cowetadentalsleeptherapy.com/uploads/1/3/0/6/130639304/2017679.pdf
- http://showtimetravelegency.com/uploads/1/3/0/7/130738752/32426.pdf
- http://scottcarlic.com/uploads/1/3/0/6/130604642/vijonuxitavimir.pdf
- http://www.readytech.net/uploads/1/3/0/7/130739117/6569462.pdf
- http://skinbeautybymaggie.com/uploads/1/3/0/3/130323814/ce9f4.pdf
- http://eaglemountainhouse.devsite-1.com/uploads/1/3/0/6/130605493/130605493.html#solvent+nmr+shifts
- http://www.ascendercorp.com/
- http://www.ascendercorp.com/typedesigners.html
- https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00003639.bin` `edf0fb7711c18e8c95fbb4fe00c16b5eb8093a7dd764ec650e6d855741783569`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x3639	2944 bytes
`font_01_sfnt_off00004367.bin` `4cc4bfdab3c809e6b0c56263d297f0fbd093453ce8c32ee2c5b0267eef9aedf9`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4367	8632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.