Malicious PDF — malware analysis report

Static analysis result for SHA-256 65518714cfe5c180…

MALICIOUS

PDF

38.6 KB Authoring application: ImageMagick
MD5: d7cc04778dcd5cda969984ff9ce6a43d SHA-1: 5a3d20c01d262ec9aabcc042afee15a68b94a0b7 SHA-256: 65518714cfe5c180410ead7b5e5c11d04c248ebc4317501d4fe399b476a38ad5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files on different domains. This suggests a tactic to manipulate search engine results or distribute malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://computatumservices.net/uploads/1/3/0/4/130483869/wiguga.pdf
    • http://maniacalragetv.net/uploads/1/3/0/5/130589006/pejikogu_sigapugag_zadivuduzipopew_bosojigemel.pdf
    • http://merchleaf.com/uploads/1/3/0/6/130620764/lebuzagi-woxanebemutib-wixojuf-jukumakuwuteri.pdf
    • http://www.bggloballogistics.com/uploads/1/3/0/5/130544352/dimejixisuma_falem_xavapirumoxod.pdf
    • http://finemexican.com/uploads/1/3/0/5/130590431/b246f5006516c.pdf
    • http://erica-anderson.com/uploads/1/3/0/7/130776316/duxeg.pdf
    • http://nanomat2019.com/uploads/1/3/0/5/130588415/naxamumer-piwulisu.pdf
    • http://www.clnfashion.com/uploads/1/3/0/5/130588668/fimizifaz-worike-nojewevinemeg-denugobig.pdf
    • http://jackiehardaker-spiritualist.co.uk/uploads/1/3/0/6/130639450/788606.pdf
    • http://visitcaddogap.net/uploads/1/3/0/6/130639800/72bab2222a33.pdf
    • http://justiceanddignity.org/uploads/1/3/0/7/130739772/dumaxezokabum.pdf
    • http://azaharaong.com/uploads/1/3/0/6/130621719/9873451.pdf
    • http://recruit1775.com/uploads/1/3/0/5/130545429/0b58a52c15.pdf
    • http://playersshack.com/uploads/1/3/0/6/130620501/4035730.pdf
    • http://hostmaster.diled.eu/uploads/1/3/0/2/130289238/8507480.pdf
    • http://themanbouquet.com/uploads/1/3/0/3/130313564/130313564.html#how+to+write+a+cover+letter+columbia+university

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003b69.bin
7c6cc9309d4e76652466c11f28c4248e89165b86053be7d4d1d5bb0229ea0997		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B69 8096 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.