Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c32260e76bb8ab1…

MALICIOUS

PDF

39.0 KB Authoring application: SWFTools
MD5: 350887c048eca4599573680139e99740 SHA-1: 3aa541fdfe2703c95188c3c0bb64aafc52bb3e6e SHA-256: 6c32260e76bb8ab1463868e78372f57206002eb73824d8e17e409c2bc188441c
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document exhibits characteristics of an advance-fee scam, containing language related to lotteries, prizes, and parcel deliveries. It embeds a large number of external links, likely intended to redirect users to malicious websites for phishing or malware distribution. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://letzcook.net/uploads/1/3/0/6/130622110/babavikegusibiz_wojan.pdf
    • http://activeachievers.com/uploads/1/3/0/7/130738780/nejawisozojebofalu.pdf
    • http://netherlands-korea.com/uploads/1/3/0/7/130740087/494e8ac647f4f8.pdf
    • http://strongarmcafe.com/uploads/1/3/0/6/130639956/2e6bf68.pdf
    • http://www.sherbygang.com/uploads/1/3/0/6/130605230/zasudidojonedi-duwavufasig.pdf
    • http://vintageautolit.com/uploads/1/3/0/5/130543761/dediwetavuxudomoxoxa.pdf
    • http://icfem-registration.com/uploads/1/3/0/5/130551700/jilupilajat.pdf
    • http://homeownersfromhell.net/uploads/1/3/0/7/130740438/c259ce4ddf12.pdf
    • http://arkiv.rokus.no/uploads/1/3/0/5/130543050/db28ea31aae56c7.pdf
    • http://hautestew.com/uploads/1/3/0/2/130288447/tutukenozazo.pdf
    • http://maryleblanc.net/uploads/1/3/0/7/130776492/1232909.pdf
    • http://longhollow.net/uploads/1/3/0/5/130543028/wizulifowaxijal_sopizot.pdf
    • http://ntwc.group/uploads/1/3/0/4/130489075/366bf05a2740a61.pdf
    • http://antiguarentalhouse.com/uploads/1/3/0/6/130603900/2630880.pdf
    • http://naughtonsandblastinggalway.com/uploads/1/3/0/2/130274370/e55a0.pdf
    • http://www.onlineheimat.de/uploads/1/3/0/4/130435684/siroguvebo.pdf
    • http://nuevaconciencia.info/uploads/1/3/0/5/130589145/vefofo_xojufunagison_tijoxopew_pukenilavojopa.pdf
    • http://mindfieldus.com/uploads/1/3/0/5/130550982/816024.pdf
    • http://mydrygiene.com/uploads/1/3/0/4/130435710/siguza.pdf
    • http://ryanballonlineportfolio.com/uploads/1/3/0/8/130814229/cdc38442816ee.pdf
    • http://laspromos.com/uploads/1/3/0/2/130292104/805a5821dc.pdf
    • http://www.arreglofix.com/uploads/1/3/0/7/130739198/130739198.html#individual+short+term+disability+insurance+aflac

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000377c.bin
2adbf98d8616d287080a894ed0a2c4eea26c2d95e5c99450bc57c3e1b1e89550		 pdf-font-stream PDF embedded font (sfnt) at offset 0x377C 8132 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.