Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c62070be66ae6fc…

MALICIOUS

PDF

47.7 KB Authoring application: Inkscape
MD5: cd3ee928e591cc98b37b73739a2f537d SHA-1: 41a549f82a9d1c6379fdb62f031a7d552c5cf5fc SHA-256: 6c62070be66ae6fcdabb082d0e228e7af170f9108a5abcbf8a1add8fd5eb94ee
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier. It contains a large number of embedded URLs pointing to other PDF files, suggesting a link farm or a distribution mechanism for further malicious content. The document body is heavily obfuscated and unreadable, preventing a deeper analysis of its specific intent beyond the heuristic findings.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.thekimamayasaedd.com/uploads/1/3/0/5/130588928/binuwigon.pdf
    • http://welcometobartertown.com/uploads/1/3/0/7/130775672/7077402.pdf
    • http://direccionsolex.com/uploads/1/3/0/7/130775386/190700.pdf
    • http://1050catalpa.com/uploads/1/3/0/5/130540282/rikari.pdf
    • http://thefastshopp.com/uploads/1/3/0/8/130874269/mixekaledexata.pdf
    • http://christianrmcdaniel.com/uploads/1/3/0/4/130488580/kakupopelusot.pdf
    • http://veluntab.store/uploads/1/3/0/3/130323181/sasudogu_pozibabevukabu.pdf
    • http://erguvanmobilya.com/uploads/1/3/0/5/130539933/turuluj_majopuw.pdf
    • http://myphonexpress.com/uploads/1/3/0/6/130621435/8898521.pdf
    • http://ravenlunaticart.com/uploads/1/3/0/7/130776255/ebd8ab680c0.pdf
    • http://newageoflight.com/uploads/1/3/0/7/130738697/lokuxowesuseva.pdf
    • http://mbartist.net/uploads/1/3/0/7/130776245/dapivutabir-fubika-dotekogek.pdf
    • http://betten-aid.com/uploads/1/3/0/6/130620783/pupubevo-mamugusev-bazisujen.pdf
    • http://swanmartialarts.com/uploads/1/3/0/3/130323302/1549192.pdf
    • http://cpanel.tanheathhunt.com/uploads/1/3/0/6/130604972/29ae8d6fab7972.pdf
    • http://mlphotoservice.com/uploads/1/3/0/7/130738707/2378ca4723bfad0.pdf
    • http://74-123-72-231.mgwnet.com/uploads/1/3/0/7/130740513/130740513.html#easy+recipes+for+advocare+24+day+challenge

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005b28.bin
958b7cbb68bc65e18d317b1ca778ba01fd4b98432df4990a27ac9418c16da4a3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5B28 9680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.