Malicious PDF — malware analysis report

Static analysis result for SHA-256 32664ba4da098498…

MALICIOUS

PDF

40.7 KB Authoring application: ImageMagick
MD5: d18c4070de897d569aa6b338431c789b SHA-1: 3214cf490c59e85599637191239fdc153f06a877 SHA-256: 32664ba4da098498fd3c9f4e352a2ffa2f50245045fe3b7ab07f6f404f7dd11f
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO poisoning or phishing campaigns. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The document body appears to be corrupted or heavily obfuscated, providing no clear textual lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nitratodargento.com/uploads/1/3/0/8/130813325/muwosetoje-velewo.pdf
    • http://chasinggrapessocial.com/uploads/1/3/0/8/130813967/wuzevanudu-wemopokate.pdf
    • http://lubatales.com/uploads/1/3/0/5/130551176/ridimubibuzumop.pdf
    • http://www.alexhernandezlawfirm.com/uploads/1/3/0/7/130775448/nuvakuxuvis-zukubomaki-moxipefirotide.pdf
    • http://wind-surfing.com/uploads/1/3/0/2/130271103/4588836.pdf
    • http://reklam5.net/uploads/1/3/0/2/130287456/lexelirulixomumi.pdf
    • http://connelyhitnews.com/uploads/1/3/0/7/130775111/vipipadusa_nilavex.pdf
    • http://blazinginformatics.com/uploads/1/3/0/5/130588221/2792925.pdf
    • http://peru.cctvradio.com/uploads/1/3/0/7/130776478/4728883.pdf
    • http://lapen.us/uploads/1/3/0/2/130272387/gaxeveloroxu.pdf
    • http://mta-sts.babydreamsmc.com/uploads/1/3/0/2/130272934/gemalesolor.pdf
    • http://catswearitsat.com/uploads/1/3/0/4/130483902/jujozipilaru.pdf
    • http://callthemformeprototype.com/uploads/1/3/0/4/130483198/a82a1.pdf
    • http://mail.mrmiraclesflooring.com/uploads/1/3/0/3/130323672/gadijo_nafufowujoxat_xubak.pdf
    • http://gloriousdiamond.com/uploads/1/3/0/6/130621622/877067a7e63e6d.pdf
    • http://n122ld.com/uploads/1/3/0/7/130738970/verigunirudi.pdf
    • http://noahcompportfolio.com/uploads/1/3/0/2/130271030/lenobexetuzapene.pdf
    • http://joanvanhoy.com/uploads/1/3/0/6/130622110/948fc91305.pdf
    • http://volnaiskra.com/uploads/1/3/0/2/130289315/pimotofux_lilobegukinalom.pdf
    • http://castawaycustomsmidwest.com/uploads/1/3/0/7/130776066/zagiwa.pdf
    • http://lucaligorio.com/uploads/1/3/0/7/130776262/39de19cc428b2f.pdf
    • http://tuijian.bpmtc.com/uploads/1/3/0/8/130874254/130874254.html#acer+aspire+one+nav50+charger
    • http://catswearitsat.com/uploads/1/3/0/4/130483902/jujozipilaru.p

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003034.bin
87fd6b1a35a64f5c2d30902eea89631a9c05d6b36ef70c6d0cee4d2ad867525e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3034 2596 bytes
font_01_sfnt_off00003c05.bin
a40c0ec4f55a36a9c78e91dbc81c28b4ec033fb099663b1f993c3653984573e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3C05 8736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.