Malicious PDF — malware analysis report

Static analysis result for SHA-256 6ea88df190bd48de…

MALICIOUS

PDF

45.5 KB Authoring application: Inkscape
MD5: 02fddf16e3546673a8a0fc193b14694f SHA-1: 391307120a1a3d9614110866b3129dd92ec00a65 SHA-256: 6ea88df190bd48dee0cf766e56f61e736cb794fd0ef544369ab680323662f728
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, detected as a 'PDF_SEO_LINK_FARM' heuristic. These links point to numerous PDF files hosted on various domains, suggesting a campaign to manipulate search engine results or distribute further malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ormansite.com/uploads/1/3/0/2/130270913/golulopu-dutodakebebodo-weleredida-nejojob.pdf
    • http://morganisalive.com/uploads/1/3/0/7/130739719/nejofutazeve.pdf
    • http://www.jasonliebsonmusic.com/uploads/1/3/0/2/130287973/392ca2ce40cf5bc.pdf
    • http://thinkhappyvibehappy.com/uploads/1/3/0/7/130775447/2123621.pdf
    • http://www.bengalsofvalhalla.com/uploads/1/3/0/4/130435596/9340892.pdf
    • http://yiechan.com/uploads/1/3/0/2/130272092/6268430.pdf
    • http://oratert.host/uploads/1/3/0/5/130590059/94ac25.pdf
    • http://shsucommunityconnections.com/uploads/1/3/0/7/130739991/gonobotetof-bowas-boseje.pdf
    • http://derjusa.com/uploads/1/3/0/3/130313340/zevixamivininu_mofuzakipi_zejemeful_kamet.pdf
    • http://nflar.club/uploads/1/3/0/8/130813650/6626180.pdf
    • http://106redirect.com/uploads/1/3/0/5/130543991/1543866.pdf
    • http://nolaclay.com/uploads/1/3/0/5/130551231/vejegoxu.pdf
    • http://misbirmingham.com/uploads/1/3/0/5/130550838/fusamuvoresa.pdf
    • http://civiccoalition-jerusalem.org/uploads/1/3/0/4/130483477/vujoraxojikoxid.pdf
    • http://norwooddentalblog.com/uploads/1/3/0/7/130775942/bitajaxekenubaw_bolago_kedefegexus.pdf
    • http://chinaesp.net/uploads/1/3/0/8/130814967/befajutuni-zijal.pdf
    • http://a1000575xstreamtravel.xsideas.com/uploads/1/3/0/5/130540525/130540525.html#best+weight+gain+foods+for+skinny+guys

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005670.bin
b77c25aeaedfa4671203a14edabb36d97fd6db1c8e916a6790b261ec8bad15bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5670 8112 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.