Malicious PDF — malware analysis report

Static analysis result for SHA-256 6621654445073a35…

MALICIOUS

PDF

37.8 KB Authoring application: GIMP
MD5: 40bff9afaec1b88a45cc559a0e373249 SHA-1: b19799a741ee861ba20dbb2fc4965133127256d5 SHA-256: 6621654445073a3550784831daf2cd7d6c4559a71478875314ba3d8fbaa664aa
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute further malicious content. ClamAV detected this file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', and a critical heuristic identified it as a PDF link farm. The ML classifier also flagged it with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mn-servicellc.com/uploads/1/3/0/7/130776444/0c9a14978fd.pdf
    • http://www.bowensnotary.com/uploads/1/3/0/9/130969364/topeger.pdf
    • http://sm-guide.xyz/uploads/1/3/0/5/130542935/9743295.pdf
    • http://cissoise.com/uploads/1/3/0/5/130589260/rolejapuzejipab_rimejanil_tudewopeduluxu_fasoxu.pdf
    • http://stresswiseatwork.com/uploads/1/3/0/6/130620601/7065168.pdf
    • http://rusewood.net/uploads/1/3/0/5/130551390/8087510.pdf
    • http://promarkprinting.com/uploads/1/3/0/7/130775838/lixixaveruzepiwar.pdf
    • http://rockyridgeacres.org/uploads/1/3/0/4/130475994/kotegatemaf.pdf
    • http://derlungenarzt.com/uploads/1/3/0/7/130740363/zemevojujadunes.pdf
    • http://hvzaction.com/uploads/1/3/0/5/130551187/d7c9d28d8e.pdf
    • http://kicknice.net/uploads/1/3/0/7/130738871/golulirujuzuw.pdf
    • http://cherishedrubies.com/uploads/1/3/0/2/130289638/sofaxuseke.pdf
    • http://machinetrader.net/uploads/1/3/0/6/130639382/98280c7c822.pdf
    • http://lkdb.net/uploads/1/3/0/5/130590355/b49941b7.pdf
    • http://www.spanishwithflor.org/uploads/1/3/0/7/130738850/fb2ff81b38c.pdf
    • http://www.seresort.com/uploads/1/3/0/6/130621809/5201671.pdf
    • http://determinedtolearn.net/uploads/1/3/0/5/130550953/xasirofo.pdf
    • http://www.vikkiamcmahon.com/uploads/1/3/0/5/130540437/89a5457b1e6bf2.pdf
    • http://carolynholder.com/uploads/1/3/0/5/130539341/jepik-nalamab.pdf
    • http://myartisanapparel.com/uploads/1/3/0/4/130488861/dipufilodadetupa.pdf
    • http://www.triplecreekbuildersllc.com/uploads/1/3/0/6/130604657/2601048.pdf
    • http://highjohnroot.com/uploads/1/3/0/2/130272918/7322047.pdf
    • http://laurenandersonrealty.com/uploads/1/3/0/3/130323332/nowivakirop.pdf
    • http://reportproduct.com/uploads/1/3/0/7/130775731/zovibatetepamatu.pdf
    • http://thetranquilgoat.com/uploads/1/3/0/6/130640021/durazeju.pdf
    • http://aldensuites.devsite-1.com/uploads/1/3/0/5/130589199/130589199.html#solving+quadratic+equations+practice+questions

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000031ca.bin
64d39e1469818c77a9978acb25e39f79775dda0a6df94140bac43cdcc7bf8357		 pdf-font-stream PDF embedded font (sfnt) at offset 0x31CA 7148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.