Malicious PDF — malware analysis report

Static analysis result for SHA-256 6f32abfb92470fb8…

MALICIOUS

PDF

42.6 KB Authoring application: Inkscape
MD5: 46a365544f7b148d71a3c331bfd9cb31 SHA-1: ebf22a39d4a7df19c67ff1c13b35d9b9d1be88da SHA-256: 6f32abfb92470fb8421089b2a05e185a4124bf7cb3c32d4dd50899e3ead784b1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malicious payloads. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically identified as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. While no scripts were explicitly extracted, the structure and URL farm suggest a phishing or content distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://crinem.com/uploads/1/3/0/5/130589056/namubala-dadumuxajulari.pdf
    • http://theordinaryvoter.com/uploads/1/3/0/6/130604102/8004f66babb74dc.pdf
    • http://victoryzavod.weebly.com/uploads/1/3/0/6/130639404/kiteti_luwexe_jumufaloliti.pdf
    • http://shcdesignsllc.com/uploads/1/3/0/5/130542909/tigoxopekibe-rabumew-panomufo.pdf
    • http://slforeignpolicy2017.lk/uploads/1/3/0/4/130476974/1426fb.pdf
    • http://petesfishtales.com/uploads/1/3/0/2/130287533/majepitiviwoge_surixuvekode_bitoziv.pdf
    • http://gel.kamafishing.ru/uploads/2020/01/28/vibeveri_tawiro_pekofajes_vudes.pdf
    • http://summit-drywall.weebly.com/uploads/1/3/0/3/130324326/7994877.pdf
    • http://fezij.favorsvet.com/uploads/2020/01/27/7985450.pdf
    • http://cadenceresource.com/uploads/1/3/0/6/130639074/xazamidut_vorerumugik_jolode_vudadoxutisinor.pdf
    • http://budsmotorauctions.com/uploads/1/3/0/4/130488816/9820035.pdf
    • http://magdasita.studio/uploads/1/3/0/4/130490808/9293203.pdf
    • http://mankatocomedy.com/uploads/1/3/0/5/130551464/faxifem.pdf
    • http://paxalul.listicdana.com/uploads/2020/01/28/977a3237.pdf
    • http://longmont66.com/uploads/1/3/0/6/130605405/davumusinox_lesalivi_zuzajezo_tipixarufi.pdf
    • http://mnemolyse.com/uploads/1/3/0/6/130621964/598104.pdf
    • http://alanjbesquin.com/uploads/1/3/0/3/130379843/8239498.pdf
    • http://kimchibabe.com/uploads/1/3/0/3/130313161/davabukave.pdf
    • http://crozetaces.org/uploads/1/3/0/2/130271015/130271015.html#bertolt+brecht+baal+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015e4.bin
04090be0bbaca918b22dbc6e5c0bfc1123ae8fe8da061e7b793fc5a413d9eb50		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15E4 8596 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.