Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c1dc00f96f7aa3a…

MALICIOUS

PDF

37.5 KB Authoring application: Inkscape
MD5: e9698ea6810fd7a39a25fe8b11ce15a9 SHA-1: 7bc35a79b2743ec76b7f521eb1cadd4a64b578c1 SHA-256: 4c1dc00f96f7aa3ad10e9e4c71a749fb270b993e99901b0ef8b95c7142f96970
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical finding for a link farm and ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0. The document body contains numerous URLs, with the primary one being http://mswilliamsonline.com/uploads/1/3/0/3/130324136/misudusapapuxev.pdf. This suggests the document's purpose is to lure users to click on these links, likely leading to phishing or malware download sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mswilliamsonline.com/uploads/1/3/0/3/130324136/misudusapapuxev.pdf
    • http://nathansenner.weebly.com/uploads/1/3/0/4/130483783/deter_tolukuja.pdf
    • http://murrietasalvationarmy.org/uploads/1/3/0/5/130588982/nijogazemexuzew-gutujone-migogi-musegizobi.pdf
    • http://ororossodelmonferrato.com/uploads/1/3/0/5/130589287/9692345.pdf
    • http://korixa.winpoker.org/uploads/2020/01/28/bomolamu.pdf
    • http://radioarcana.org/uploads/1/3/0/5/130551089/394225d71.pdf
    • http://largotermiteinspection.com/uploads/1/3/0/6/130621397/556590.pdf
    • http://kurokobrothers.com/uploads/1/3/0/5/130588560/jixusepo-tapobor-zowobur-zanafagekowemos.pdf
    • http://perceptualteaching.org/uploads/1/3/0/5/130545745/buwojapanogiga-vuzarovobijurok-dojixot.pdf
    • http://birrddy.com/uploads/1/3/0/4/130476493/045b8.pdf
    • http://cgexitmaterials.com/uploads/1/3/0/3/130379696/7536558.pdf
    • http://nitoja.ajarnarm.com/uploads/2020/01/28/7dbe74e4eaa3fb2.pdf
    • http://solodarchi.com/uploads/1/3/0/5/130551366/lajowedo-zewod-pofunisowawi.pdf
    • http://putibikope.kardio-control.ru/uploads/2020/01/28/kawilevibesid.pdf
    • http://bethegoodhands.com/uploads/1/3/0/4/130477805/fiwanijud-fepiz-luvarutelok.pdf
    • http://mowerok.com/uploads/1/3/0/2/130287521/bf765d5a.pdf
    • http://luwe.iceworld.fun/uploads/2020/01/28/zoxir-fizivog.pdf
    • http://prestigeeminence.com/uploads/1/3/0/6/130604192/tetixum.pdf
    • http://hello-baby-toys.com/uploads/1/3/0/3/130313480/130313480.html#dried+green+peas+nutrition+information

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001568.bin
9e7a91289e200b8a194dada874a5eaef86d74e0b4f0876254965693a1f7055fd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1568 7904 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.