Malicious PDF — malware analysis report

Static analysis result for SHA-256 301a10b4641f8636…

MALICIOUS

PDF

62.0 KB Authoring application: ImageMagick
MD5: e86fb26d8ba0d8c120b43b66a43fdf79 SHA-1: 62966fb6ab7a2f51417e78a0d40919addc0993c2 SHA-256: 301a10b4641f8636a23f46d4b2bd7d7c1f45033c44fa32225a0cd62b1be7d18b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further indicate malicious intent. The document body, while containing text about a quiz, also embeds multiple links, reinforcing the attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://blackwinghunting.com/uploads/1/3/0/6/130640133/gosob_betax_belagola_sifobewelonenif.pdf
    • http://armydarkshadows.net/uploads/1/3/0/5/130539350/e172609cb6b1d8a.pdf
    • http://orangeparktreeservice.com/uploads/1/3/0/3/130312998/fe0283132eb9d29.pdf
    • http://natashaf.net/uploads/1/3/0/5/130588452/pifup.pdf
    • http://mygraphicdesignteam.com/uploads/1/3/0/6/130621651/manegodiju.pdf
    • http://countrystylebbqcatering.com/uploads/1/3/0/4/130483487/4558190.pdf
    • http://iweargreatness.com/uploads/1/3/0/7/130775503/130775503.html#brachial+plexus+muscle+innervation+quiz

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011e5.bin
8d0e48ac6ad96a82a8737b79ab325d314a865b0e15646bbc68ca5bdd4f237cfc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11E5 8724 bytes
font_01_sfnt_off0000abd5.bin
3e0ebdb8948f3c9c7024f1e93b1c0b167e987bcdf2a5b7025ed3bcc2dbf3b9f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0xABD5 16584 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.