PDF malware analysis — malicious · 4ac58c750896e41a

MALICIOUS

PDF

42.2 KB Authoring application: GIMP

MD5: 2a53f06d00189c249aa6d6c87dcc50e1 SHA-1: da880d2a3512954d36e21f7f722cf35d9c7f5bfb SHA-256: 4ac58c750896e41ae9a1dec470099bc6bab756e814977bdf0484c23eb4ea4c1d

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also strongly suggest malicious intent. The primary purpose appears to be directing users to a link farm, likely for SEO abuse or to host further malicious content.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://farmlawyer.com/uploads/1/3/0/5/130589384/fusewe.pdf
- http://amongotherrunners.com/uploads/1/3/0/6/130620607/6571639.pdf
- http://penguinjournal.online/uploads/1/3/0/6/130621506/bubosu.pdf
- http://planthealthcare-mortonarb.org/uploads/1/3/0/6/130621361/botot_wewevi_jumolubotun_roresi.pdf
- http://yeomansflowers.com/uploads/1/3/0/7/130738993/mojijeruvejip.pdf
- http://fiendfanzine.club/uploads/1/3/0/6/130621031/jijoxope.pdf
- http://poko.chat/uploads/1/3/0/2/130289782/buvubinak-zufabatal-modabutemezeva.pdf
- http://us41marion.com/uploads/1/3/0/7/130775972/50406584cc5.pdf
- http://www.colorobstaclerush.eu/uploads/1/3/0/8/130814669/535566.pdf
- http://assric.org/uploads/1/3/0/6/130621502/vitelofodolivi.pdf
- http://defiesmeasurement.com/uploads/1/3/0/4/130476272/130219.pdf
- http://thebacqroom.com/uploads/1/3/0/7/130775705/2317920.pdf
- http://strawhatgames.com/uploads/1/3/0/5/130551457/kapivisiwepa.pdf
- http://podollangpis.devsite-1.com/uploads/1/3/0/6/130639656/646186.pdf
- http://guiasregionais.com/uploads/1/3/0/7/130739472/282562800ca8.pdf
- http://poerecords.net/uploads/1/3/0/2/130271085/fumulok_titadagukek_musilu_firux.pdf
- http://futureofwork2018.com.au/uploads/1/3/0/7/130738964/412354d2cf.pdf
- http://modibra.com/uploads/1/3/0/2/130273798/wazivegiwelaxa.pdf
- http://420fitness.jimmysjava.com/uploads/1/3/0/5/130541384/bugadaguwatumom.pdf
- http://www.bethelamechurchluling.com/uploads/1/3/0/6/130605077/zipapulorawigagowe.pdf
- http://lcdigitalconnect.com/uploads/1/3/0/2/130271004/kinigil.pdf
- http://nursingarmpillow.com/uploads/1/3/0/2/130289595/8319962.pdf
- http://pressurewashingtorrance.com/uploads/1/3/0/4/130476089/jawedomexi_dasubagoje_wadofilifulixe_siwiv.pdf
- http://northmetrotrustedprofessionals.com/uploads/1/3/0/2/130289411/2321250.pdf
- http://sacasta.voyagerwebsites.com/uploads/1/3/0/5/130540214/130540214.html#2.5+cm+grid+paper+printable
- http://futureofwork2018.com.au/uploads/1/3/0/7/130738964/412354d2cf

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00002bc2.bin` `779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2BC2	16036 bytes
`font_01_sfnt_off000042a5.bin` `caf1c7c0a3659c5271fd05a83b0f73be0a660887a068b95c0097a728d0d0a044`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x42A5	7468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.