Malicious PDF — malware analysis report

Static analysis result for SHA-256 661288ba4797993c…

MALICIOUS

PDF

52.6 KB Authoring application: ImageMagick
MD5: 67a7a94c086fe5f92387c61ba0732520 SHA-1: bff79803a658e46a6004c5836373338e3ca3474e SHA-256: 661288ba4797993c66c6e3df0f83583385ac5f1bdc2987ada5b28945a52e1c8c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified as a link farm, which is a common technique for SEO manipulation or distributing malicious content. The ClamAV detection and ML classifier strongly indicate maliciousness, specifically pointing to phishing or bot-like activity. While no scripts were explicitly extracted, the embedded URLs are the primary indicators of malicious intent, likely leading to further compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schoolfundingnow.org/uploads/1/3/0/5/130542936/6940376.pdf
    • http://gorgeousmicrobladinglashfacial.com/uploads/1/3/0/3/130313314/377a3301bb8e3.pdf
    • http://www.shop.treasuretrovetoffee.com/uploads/1/3/0/8/130814279/84228e9c.pdf
    • http://royaldaiimond.com/uploads/1/3/0/7/130775370/0541054f849.pdf
    • http://myownbank.co.uk/uploads/1/3/0/7/130739232/xifenagib-zojibimani.pdf
    • http://cmedillustrations.com/uploads/1/3/0/6/130604270/b1858215cb21078.pdf
    • http://www.psitau.com/uploads/1/3/0/5/130543543/rojetizaxoriz.pdf
    • http://aitoronto.org/uploads/1/3/0/7/130739474/sujikideba_narizup_lilojudar_pigoxogefap.pdf
    • http://sacredsecretskincare.org/uploads/1/3/0/8/130874379/f608a6.pdf
    • http://mountyhorseandsports.com/uploads/1/3/0/6/130621354/zufum.pdf
    • http://thefishingbuddy.org/uploads/1/3/0/6/130622009/97045.pdf
    • http://u5wotw.bdgct.com/uploads/1/3/0/7/130775321/130775321.html#why+is+sickle+cell+anemia+a+good+example+of+heterozygote+advantage
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000051fd.bin
bb918e98680bf57c6326be80ba828a2fdefab142051b8094b72ead743c0f2a05		 pdf-font-stream PDF embedded font (sfnt) at offset 0x51FD 16108 bytes
font_01_sfnt_off0000667b.bin
7143d3dd6d37032a5360bdcb7247578716bec29247918718247d8d5ea3ed48be		 pdf-font-stream PDF embedded font (sfnt) at offset 0x667B 3344 bytes
font_02_sfnt_off000074da.bin
82b007489e8d45d96a305f7c13443adedb69dbd244a85587279931e70c0ad371		 pdf-font-stream PDF embedded font (sfnt) at offset 0x74DA 8888 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.