Malicious PDF — malware analysis report

Static analysis result for SHA-256 634dc11eb61a6767…

MALICIOUS

PDF

38.4 KB Authoring application: Scribus
MD5: db46049f12a311f97196ad9829459478 SHA-1: 9f7ae960ca9a0cfc765dcbaa1b491227990e2711 SHA-256: 634dc11eb61a67670d194311b4c25e90860135de5ff5985d7e101d68a6bc8e3f
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The heuristic 'PDF_SEO_LINK_FARM' and the ML classifier strongly indicate malicious intent. Although no scripts were explicitly extracted, the embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) documents that carry no urgency or charge/dispute escalation.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://truurelief.com/uploads/1/3/0/2/130289393/9181726.pdf
    • http://oasisgaminginc.com/uploads/1/3/0/6/130639308/zegunotu.pdf
    • http://bojemef.com/uploads/1/3/0/7/130776519/bbded04bdae75.pdf
    • http://bigbonedfitness.com/uploads/1/3/0/8/130814803/583330.pdf
    • http://translantau.transasiaseries.com/uploads/1/3/0/3/130313122/gabanobakiwodowatape.pdf
    • http://palmsecurityservices.com/uploads/1/3/0/5/130590535/dodesi-detodu-wedokabejiwibo.pdf
    • http://natashiapandther.com/uploads/1/3/0/5/130589277/1663192.pdf
    • http://callingourselveshome.weebly.com/uploads/1/3/0/6/130604667/3bd56.pdf
    • http://ne-surgerycenter.net/uploads/1/3/0/2/130272524/130272524.html#word+to+pdf+small+pdf+converter

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000142d.bin
7a83752c4abd8919505e48a22fbc7ece89c2a4dceee500136a45bc98a895d9d9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x142D 12292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.