Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c62070be66ae6fc…

MALICIOUS

PDF

47.7 KB Authoring application: Inkscape First seen: 2020-09-15
MD5: cd3ee928e591cc98b37b73739a2f537d SHA-1: 41a549f82a9d1c6379fdb62f031a7d552c5cf5fc SHA-256: 6c62070be66ae6fcdabb082d0e228e7af170f9108a5abcbf8a1add8fd5eb94ee
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains a large number of embedded URLs pointing to other PDF files, suggesting a link farm or a distribution mechanism for further malicious content. The document body is heavily obfuscated and unreadable, preventing a deeper analysis of its specific intent beyond the heuristic findings.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.thekimamayasaedd.com/uploads/1/3/0/5/130588928/binuwigon.pdf In PDF document text
    • http://welcometobartertown.com/uploads/1/3/0/7/130775672/7077402.pdfIn PDF document text
    • http://direccionsolex.com/uploads/1/3/0/7/130775386/190700.pdfIn PDF document text
    • http://1050catalpa.com/uploads/1/3/0/5/130540282/rikari.pdfIn PDF document text
    • http://thefastshopp.com/uploads/1/3/0/8/130874269/mixekaledexata.pdfIn PDF document text
    • http://christianrmcdaniel.com/uploads/1/3/0/4/130488580/kakupopelusot.pdfIn PDF document text
    • http://veluntab.store/uploads/1/3/0/3/130323181/sasudogu_pozibabevukabu.pdfIn PDF document text
    • http://erguvanmobilya.com/uploads/1/3/0/5/130539933/turuluj_majopuw.pdfIn PDF document text
    • http://myphonexpress.com/uploads/1/3/0/6/130621435/8898521.pdfIn PDF document text
    • http://ravenlunaticart.com/uploads/1/3/0/7/130776255/ebd8ab680c0.pdfIn PDF document text
    • http://newageoflight.com/uploads/1/3/0/7/130738697/lokuxowesuseva.pdfIn PDF document text
    • http://mbartist.net/uploads/1/3/0/7/130776245/dapivutabir-fubika-dotekogek.pdfIn PDF document text
    • http://betten-aid.com/uploads/1/3/0/6/130620783/pupubevo-mamugusev-bazisujen.pdfIn PDF document text
    • http://swanmartialarts.com/uploads/1/3/0/3/130323302/1549192.pdfIn PDF document text
    • http://cpanel.tanheathhunt.com/uploads/1/3/0/6/130604972/29ae8d6fab7972.pdfIn PDF document text
    • http://mlphotoservice.com/uploads/1/3/0/7/130738707/2378ca4723bfad0.pdfIn PDF document text
    • http://74-123-72-231.mgwnet.com/uploads/1/3/0/7/130740513/130740513.html#easy+recipes+for+advocare+24+day+challengeIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005b28.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5B28 9680 bytes
SHA-256: 958b7cbb68bc65e18d317b1ca778ba01fd4b98432df4990a27ac9418c16da4a3

Open this report in the interactive analyzer, or submit your own file for analysis.