Malicious PDF — malware analysis report

Static analysis result for SHA-256 531fe3c0cb776c6d…

MALICIOUS

PDF

76.2 KB Authoring application: ImageMagick
MD5: 341ab7367ec12aaa2469c6a3943b4b4f SHA-1: a32dc10003f4f451fd81796e8dadcbe7690253d3 SHA-256: 531fe3c0cb776c6d4abbb94ade43423eeea2e6472d1fa548c19f80506a39518b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDF files hosted on various domains, indicating a link farm or redirection strategy. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly suggest malicious intent, likely related to phishing or traffic generation. The document body is heavily obfuscated and unreadable, providing no direct clues to the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://proorganizerlindsay.com/uploads/1/3/0/7/130739776/f3fd8c.pdf
    • http://gtafrica.net/uploads/1/3/0/7/130739224/tuxadib.pdf
    • http://mta-sts.mx.santasjinglehouse.com/uploads/1/3/0/4/130488820/9001174.pdf
    • http://sail-and-yoga.com/uploads/1/3/0/4/130476712/nurofiwaminasudo.pdf
    • http://smartgurls.com/uploads/1/3/0/4/130483804/1170129.pdf
    • http://proedge406.com/uploads/1/3/0/7/130775879/8290231.pdf
    • http://www.english.duoduo.fi/uploads/1/3/0/8/130814058/futoma-bususibexerido-mudemumuto-wetazin.pdf
    • http://cockclock.com/uploads/1/3/0/7/130775756/towazaxuforet_ponunakabupexi_vubaladota.pdf
    • http://bobsbikes.net/uploads/1/3/0/5/130541208/5bf25da3f18fb.pdf
    • http://statewidelandsales.com/uploads/1/3/0/5/130547142/2750778.pdf
    • http://cleaningstgeorge.com/uploads/1/3/0/4/130488371/duwefej_lusumilovoza_fojowu.pdf
    • http://asoldiersdeath.com/uploads/1/3/0/4/130435536/c4bd4e.pdf
    • http://cityestateagent.com/uploads/1/3/0/6/130604770/sikokutewada.pdf
    • http://derbycitybreakers.com/uploads/1/3/0/5/130545365/2cfa572ca1.pdf
    • http://deas-guyz.com/uploads/1/3/0/6/130639294/norijopirepel_najof_suwufunodaw_zanijazat.pdf
    • http://nakayamaus.com/uploads/1/3/0/6/130605421/dajiximiketoru_bumofofolat_redepaxademudag.pdf
    • http://kencot.net/uploads/1/3/0/6/130604148/130604148.html#movement+of+bacteria+flagella+with+respect+to+attractants

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000022f1.bin
b405a29af0b31cf0c114a3bfca0348459d99767163c57f30764dc89e646bea5d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x22F1 10168 bytes
font_01_sfnt_off0000e460.bin
088c762e0816e812f8952a6fc4305515bf9e3f0ab8d12c689ecaeaec55c3a5eb		 pdf-font-stream PDF embedded font (sfnt) at offset 0xE460 16476 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.