Malicious PDF — malware analysis report

Static analysis result for SHA-256 2e688c28a4d3e212…

MALICIOUS

PDF

40.5 KB Authoring application: Inkscape
MD5: cce9c3058bbaf473d8d215794f2c2036 SHA-1: d1b625e7218424f181f705feee8693713aa6f48b SHA-256: 2e688c28a4d3e2124b0bd5d711db9846b71a861d6a25392ae4debd5887b44728
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The critical PDF_SEO_LINK_FARM heuristic indicates the presence of a large number of external links, with the first identified URL being http://culturalovers.org/uploads/1/3/0/7/130739975/kipugep_wazexuxi.pdf. This suggests the document is likely part of a phishing or SEO spam campaign designed to redirect users to malicious content hosted on numerous domains.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://culturalovers.org/uploads/1/3/0/7/130739975/kipugep_wazexuxi.pdf
    • http://millersgardenservicessuffolk.co.uk/uploads/1/3/0/6/130604710/8178551.pdf
    • http://projectusandthem.com/uploads/1/3/0/3/130313088/334b1e3553fc.pdf
    • http://carsonmugs.com/uploads/1/3/0/5/130542728/sakurefibatupuv.pdf
    • http://mypurplelilyboutique.com/uploads/1/3/0/5/130588605/1651909.pdf
    • http://pcfuganda.org/uploads/1/3/0/5/130551021/kudifukimutimepeje.pdf
    • http://bfndorganics.com/uploads/1/3/0/2/130289479/6996517.pdf
    • http://northernsoundandvideo.net/uploads/1/3/0/4/130490915/4638e31265.pdf
    • http://botoxformenatlanta.com/uploads/1/3/0/7/130775692/b2413ba1.pdf
    • http://knoxfoodtours.com/uploads/1/3/0/5/130541208/b81ca80.pdf
    • http://madeiradaarca.com/uploads/1/3/0/4/130436154/fivozevakapikepobi.pdf
    • http://centerofpeacefulendeavors.com/uploads/1/3/0/7/130739933/130739933.html#free+triple+yahtzee+score+cards+printable

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001303.bin
3eb459d28647aebfab6375f22b48f91f6bd8b48170791cee7362621d91743e67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1303 8808 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.