Malicious PDF — malware analysis report

Static analysis result for SHA-256 16bf19e8359e6348…

MALICIOUS

PDF

41.2 KB Authoring application: GIMP
MD5: d1adedd0115480fd8dd19f5210dc2d06 SHA-1: 2d7ed3957fdd9673fcf04459adf1e052a80b6327 SHA-256: 16bf19e8359e63483249485442191d0402ecdcb419a80e1fb8202cab7c6b5e7b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of embedded URLs pointing to other PDF files, suggesting a link farm or a distribution mechanism for further malicious content. The document body itself appears to be corrupted or heavily obfuscated, preventing a clear understanding of its immediate user-facing purpose beyond the link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://danaink.org/uploads/1/3/0/2/130272417/titemitoti-xixojonus-rediwo.pdf
    • http://xpath101.com/uploads/1/3/0/8/130873903/patinijojekonavomez.pdf
    • http://cardboardbuild.com/uploads/1/3/0/3/130379463/b47012c64e56a2a.pdf
    • http://my365tutors.net/uploads/1/3/0/7/130775986/wewipepo_firete_jowitikojivol_mutowifuxojugi.pdf
    • http://utilityoftucson.com/uploads/1/3/0/5/130588294/gesagas.pdf
    • http://mta-sts.mail.natashapincus.com/uploads/1/3/0/3/130323180/tulevotujapa.pdf
    • http://thebravesboard.com/uploads/1/3/0/3/130323409/9873d7f.pdf
    • http://bmphotographer.com/uploads/1/3/0/4/130477039/e83e77585a38.pdf
    • http://nexus.ph/uploads/1/3/0/3/130379517/9ac51.pdf
    • http://nlccpsw.org/uploads/1/3/0/7/130739528/jisoruforokiw.pdf
    • http://babyg-lash.com/uploads/1/3/0/5/130541351/19c8440.pdf
    • http://pavanmehat.com/uploads/1/3/0/7/130740591/721172.pdf
    • http://thembmethod.com/uploads/1/3/0/3/130323535/65159269e47b54.pdf
    • http://carterskennel.com/uploads/1/3/0/4/130489841/1642971.pdf
    • http://kithara.org.au/uploads/1/3/0/5/130590413/cb53a484e2a.pdf
    • http://kumfsteez.com/uploads/1/3/0/4/130436389/tidoguxewikaxi-piloto.pdf
    • http://prosphatos.com/uploads/1/3/0/3/130379352/lenopifopolumib.pdf
    • http://alexandrethiery.com/uploads/1/3/0/7/130776201/laxogesufujota.pdf
    • http://springvillehighblt.org/uploads/1/3/0/5/130539837/durewebugaludamogeju.pdf
    • http://creditfromhome.net/uploads/1/3/0/7/130775048/xawozuvitafolotasag.pdf
    • http://residenciales.org/uploads/1/3/0/6/130620772/wetubezixemev_vigidap.pdf
    • http://maddox-is-two.daniellerosephotography.com/uploads/1/3/0/7/130740212/130740212.html#element+3d+text+animation+presets+pack+free+download

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004100.bin
0e44a5d69ffd1a351993329e69631cb51600b6152535b289eb0745d59b8f63c0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4100 7876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.