Malicious PDF — malware analysis report

Static analysis result for SHA-256 19c6d5d8597088d8…

MALICIOUS

PDF

39.3 KB Authoring application: Inkscape
MD5: ce6ed7b5a903f1ab7c339cf479ae1e81 SHA-1: 0244a3d7be2e8c45c2e0548b431d92c740b3b584 SHA-256: 19c6d5d8597088d8022c5345fd714cfedc37daa4c0df70bbbc9476c398fb9fc6
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains a large number of embedded URLs pointing to other PDF files across various domains, indicating a link farm or distribution network. This behavior is consistent with phishing or SEO spam campaigns designed to drive traffic or host malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-driving malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://missturquoisecircuit.com/uploads/1/3/0/8/130874378/nerapewaxi.pdf
    • http://sinewmusic.com/uploads/1/3/0/6/130620642/batoxabosipewew_tasoxizuxox_fobudufirofa_dopoxeromime.pdf
    • http://doolby.net/uploads/1/3/0/5/130590403/numejuso_negidine_zipebuvox_zedekosugat.pdf
    • http://photoframerpro.com/uploads/1/3/0/5/130588332/gumevuvuxibifupo.pdf
    • http://wildmanbob.net/uploads/1/3/0/5/130589239/9667375.pdf
    • http://nekima.net/uploads/1/3/0/7/130740249/4439983.pdf
    • http://fcaknightsbaseball.org/uploads/1/3/0/6/130620917/nopupe.pdf
    • http://teenmamagrown.com/uploads/1/3/0/5/130588745/822197.pdf
    • http://darkcircle.detailap.com/uploads/1/3/0/5/130539279/c574a.pdf
    • http://www.texasranchmasters.com/uploads/1/3/0/7/130776167/2c70cf99df.pdf
    • http://300wyandotte.com/uploads/1/3/0/5/130539255/tobofofojewaduk.pdf
    • http://ministrystudy.org/uploads/1/3/0/4/130489229/3526543.pdf
    • http://shipsimsglobal.com/uploads/1/3/0/8/130873918/eccae53d23a0.pdf
    • http://www.opuscorporation.org/uploads/1/3/0/6/130621083/f9a30d233.pdf
    • http://splitnest.com/uploads/1/3/0/4/130476014/c7cfc81b2db6.pdf
    • http://livinginlayersstudio.com/uploads/1/3/0/4/130489343/06e488.pdf
    • http://hostmaster.dreamdoves.co.uk/uploads/1/3/0/5/130540609/kivepa_rerajip_kerufemugogot.pdf
    • http://www.mclaboratory.space/uploads/1/3/0/3/130324170/gatefuvasujujovubova.pdf
    • http://airportcityinvest.com/uploads/1/3/0/5/130590716/xurafetuxitu.pdf
    • http://bass4me.com/uploads/1/3/0/6/130639622/wuxig_ginejidasilulez_pikuv_vemutegupokatal.pdf
    • http://leaitani.net/uploads/1/3/0/5/130540240/47f8ed8c9f.pdf
    • http://vedicastrolink.com/uploads/1/3/0/9/130969085/f91a1134dda.pdf
    • http://metroheatingandair.com/uploads/1/3/0/7/130739128/jiviralaj.pdf
    • http://corvuspress.net/uploads/1/3/0/5/130588451/zajobew_suwimaxa_jidotiloso.pdf
    • http://74-123-78-125.mgwnet.com/uploads/1/3/0/6/130604962/130604962.html#new+english+file+elementary+teacher%27s+book+pdf
    • http://leaitani

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030cd.bin
1bc244f09b81ac4e2654a3712c610531480d7832e75e77106be835becb73ce94		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30CD 10880 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.