Malicious PDF — malware analysis report

Static analysis result for SHA-256 6193904853141a31…

MALICIOUS

PDF

38.2 KB Authoring application: Solid Converter PDF
MD5: 4ea584ccf2e125f707b81cfc71566b09 SHA-1: 6a602747f654f15f40e22dfb9ec5462f4295e9fb SHA-256: 6193904853141a316ace2a8a81b98a3ff8e9acb4fe495d8d810daa09d477d214
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection scheme. The ML classifier and ClamAV detection strongly indicate maliciousness, with ClamAV identifying it as Pdf.Phishing.TtraffRobotInstall. The SE_CALLBACK_LURE heuristic suggests a phishing or scam pretext, although the document body itself is heavily obfuscated and does not provide clear instructions. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wendtauto.com/uploads/1/3/0/6/130605161/2688505.pdf
    • http://mr-organics.eu/uploads/1/3/0/7/130739261/rekofavebezibidefu.pdf
    • http://saveearth.solutions/uploads/1/3/0/6/130639239/namaxebitidul.pdf
    • http://www.etisalat971.com/uploads/1/3/0/7/130776229/b2cf04806.pdf
    • http://jwallach.net/uploads/1/3/0/4/130435710/metovuxomi-rizejivelov-sudar.pdf
    • http://smarterinanhour.com/uploads/1/3/0/7/130775062/3882680.pdf
    • http://annepurl.com/uploads/1/3/0/7/130775376/515c686232aba.pdf
    • http://jennifer-rice.com/uploads/1/3/0/5/130588708/864330ad8ddc.pdf
    • http://www.donostia-restaurant.com/uploads/1/3/0/6/130604615/2908041.pdf
    • http://hgwise.org/uploads/1/3/0/5/130588288/lomaveb.pdf
    • http://pulsewx.com/uploads/1/3/0/3/130323295/45d9a66c76675ac.pdf
    • http://soaringfish.com/uploads/1/3/0/2/130288545/rabodotaxujonezol.pdf
    • http://soundpole.net/uploads/1/3/0/5/130588613/62bd42.pdf
    • http://xileart.com/uploads/1/3/0/5/130539866/fafuborifekazem.pdf
    • http://webdisk.ekszerekejszakaja.com/uploads/1/3/0/6/130620511/fe1836123390d63.pdf
    • http://lidokeypaddleboarding.com/uploads/1/3/0/2/130270748/xikax.pdf
    • http://host127.carmichaelnl.com/uploads/1/3/0/5/130588787/130588787.html#calculating+mean+using+grouped+data

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000038dd.bin
72a502259ee87f55b54eba66aa875b34861af9ce9d75059447d738cbd4f6b022		 pdf-font-stream PDF embedded font (sfnt) at offset 0x38DD 8396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.