Malicious PDF — malware analysis report

Static analysis result for SHA-256 61e8075430a12fb1…

MALICIOUS

PDF

38.0 KB Authoring application: Inkscape
MD5: 8c5c01f2fbaf672ecb7fe8564adc00e3 SHA-1: 65df7e33d7abdc59f525fedd6f40505a83e87f67 SHA-256: 61e8075430a12fb11c523eb7c42736eec625dd5e5e957e0748c0a8ac92c6a353
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection strategy. The ML_NYX_PDF_MALICIOUS and CLAMAV_DETECTION heuristics confirm its malicious nature, with ClamAV identifying it as Pdf.Phishing.TtraffRobotInstall. The document body contains text related to 'Airtel dth recharge offer', which is likely a lure to disguise the malicious intent of the embedded links. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://webmail.atomant.com.au/uploads/1/3/0/6/130603860/1394551.pdf
    • http://nwapetgrooming.com/uploads/1/3/0/7/130740433/f07b08.pdf
    • http://picturemehealthy.net/uploads/1/3/0/5/130589396/sudexebizol-xisemolu-jotipijag-lexomuroguv.pdf
    • http://kingstonpropertiesonline.com/uploads/1/3/0/2/130289695/jufexozaboputos-sajasusifa.pdf
    • http://noboundariespodcast.com/uploads/1/3/0/8/130813953/4b7c87970b6b93.pdf
    • http://enlightenedhealthcoaching.com/uploads/1/3/0/8/130873709/a5f896a.pdf
    • http://mgmtinsight.net/uploads/1/3/0/7/130739490/zutir_dobukivu_rikexolemos.pdf
    • http://petoskeydrones.com/uploads/1/3/0/4/130483903/gunixuwurepikonivibe.pdf
    • http://morahill.com/uploads/1/3/0/7/130739112/zotowubafavikonuduza.pdf
    • http://seajourneys.voyagerwebsites.com/uploads/1/3/0/7/130740502/jejovufupi.pdf
    • http://thetrailstownhomes.com/uploads/1/3/0/6/130603903/07c37e97.pdf
    • http://sadgorilla.com/uploads/1/3/0/5/130590383/1017372.pdf
    • http://suncitycenterhomes.com/uploads/1/3/0/7/130775484/kanumakamesobu.pdf
    • http://minyounglee8682.com/uploads/1/3/0/8/130874535/9676675.pdf
    • http://kontentsu.co/uploads/1/3/0/8/130814926/9652618.pdf
    • http://citruslist.com/uploads/1/3/0/6/130621465/kidajifafujoro-lajomaf-vudebev.pdf
    • http://theperfectsaturday.com/uploads/1/3/0/2/130287929/4174974.pdf
    • http://ww2.thumbprintgallerysd.com/uploads/1/3/0/7/130776428/6835731.pdf
    • http://nationaltrafficsolutioninc.com/uploads/1/3/0/2/130270889/xipumejakegiz.pdf
    • http://healingasone.com/uploads/1/3/0/5/130588714/6979158.pdf
    • http://angelospantego.com/uploads/1/3/0/6/130639412/3949874.pdf
    • http://suefordedtechportfolio.com/uploads/1/3/0/2/130270980/bozoziponitupa_visoz.pdf
    • http://craniosacralnashville.com/uploads/1/3/0/2/130270897/130270897.html#airtel+dth+recharge+offer+3+month

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000031c1.bin
9122b3e0fa8765e75229d38bd9d37baffadc115fadaa65f1fd71aeb2c8b2df55		 pdf-font-stream PDF embedded font (sfnt) at offset 0x31C1 8196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.