Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c53ebaa8f028ddb…

MALICIOUS

PDF

36.9 KB Authoring application: PDF Studio
MD5: 029fcec7bca9d42b3a7a36bed7273048 SHA-1: 2283681f2cf9b364e7acd357dcce3d2d8ca6b8e6 SHA-256: 6c53ebaa8f028ddb6401e0abb8ae2eca6615ec9a8f37787633e07e52ac004289
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. ClamAV detected this file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection intent. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tinksolutions.com/uploads/1/3/0/3/130323620/nuvuviz_bogapemepiwejo_bipajupulitoke_jiripanamu.pdf
    • http://www.fincalajordana.com/uploads/1/3/0/8/130814553/66d2ed5c922.pdf
    • http://supernatural-wellness.com/uploads/1/3/0/3/130313766/ead3b5899fc4.pdf
    • http://purrfectionpettransport.com/uploads/1/3/0/5/130539798/rinesek.pdf
    • http://i-bza.com/uploads/1/3/0/5/130589391/7125612.pdf
    • http://74-123-75-27.mgwnet.com/uploads/1/3/0/2/130273978/551353.pdf
    • http://mydonutbarn.com/uploads/1/3/0/4/130476146/460e6d2e85b761.pdf
    • http://friendshipcourtapartments.com/uploads/1/3/0/6/130621956/9649c4863b7.pdf
    • http://sportmodels.org/uploads/1/3/0/6/130621651/naxesojatof_ganugij.pdf
    • http://classroomsinthekitchen.com/uploads/1/3/0/6/130604803/2d6bd7739209.pdf
    • http://www.sunfloweressentials.com/uploads/1/3/0/5/130551777/6ed99aa04e206c.pdf
    • http://littlebunnieseducation.com/uploads/1/3/0/4/130436285/jiveleke.pdf
    • http://jamicide.com/uploads/1/3/0/4/130477083/xuxubenanaw.pdf
    • http://kids-discipleship.org/uploads/1/3/0/4/130435712/fifufajulo.pdf
    • http://snapjawsphotography.com/uploads/1/3/0/7/130740441/d204815d1.pdf
    • http://agencia-de-empregos.com/uploads/1/3/0/7/130740012/wixuzezifosif.pdf
    • http://rosepunch.com/uploads/1/3/0/5/130539449/31bce.pdf
    • http://prestigeholdingllc.com/uploads/1/3/0/7/130775692/wewexizuwofaza.pdf
    • http://nicenspice.com/uploads/1/3/0/7/130738949/fcdd174c8c7.pdf
    • http://www.r9.justinecandoit.com/uploads/1/3/0/7/130739714/takigari_fozaxanurumo_zekizuvivuwi_gakijigas.pdf
    • http://rx4retirement.info/uploads/1/3/0/4/130436288/1851845.pdf
    • http://musiccitypetpartners.com/uploads/1/3/0/7/130776296/gosakunutefur.pdf
    • http://74-123-75-235.mgwnet.com/uploads/1/3/0/7/130776647/130776647.html#sunsetter+motorized+awning+instructions

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030df.bin
5bdd09dd8a0b29d6f4b38eedcb1cc744065523673e9fab434eea98feff41d520		 pdf-font-stream PDF embedded font (sfnt) at offset 0x30DF 7056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.