Malicious PDF — malware analysis report

Static analysis result for SHA-256 6fac97ff12400caa…

MALICIOUS

PDF

34.0 KB Authoring application: Inkscape
MD5: 03b5971170b73f1efa8beee644295c69 SHA-1: ae921d76d1d9905b699a40f131d87b71c0e10c1f SHA-256: 6fac97ff12400caa26d20200440a567b2e9031075789bca18788ba37113ffdf7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, forming a link farm designed to redirect users to potentially malicious PDF files. The heuristic 'PDF_SEO_LINK_FARM' and ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly indicate a phishing or malware distribution scheme. While no scripts were directly extracted, the embedded URLs are the primary mechanism for delivering further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://create218.org/uploads/1/3/0/5/130590477/19cbc900f6.pdf
    • http://theshergroup.com/uploads/1/3/0/6/130604299/6696483.pdf
    • http://rexinkscreenprinting.com/uploads/1/3/0/5/130540559/2615794.pdf
    • http://natashiapandther.com/uploads/1/3/0/5/130543437/756a2e61.pdf
    • http://spectrumlifecare.net/uploads/1/3/0/2/130272440/c18a6c9a.pdf
    • http://royalinstincts.com/uploads/1/3/0/6/130603772/nobepuwulirupi-nosebagisu-jidarezuvagomex-tusarubujezeka.pdf
    • http://mylevelbest.org/uploads/1/3/0/5/130545254/wigiradopatupot-gubad-zijidenopakizub.pdf
    • http://lawncarebenton.com/uploads/1/3/0/5/130542692/xoredezedukelu.pdf
    • http://theworldofboden.com/uploads/1/3/0/6/130639669/jipojazu.pdf
    • http://myvrcpp.com/uploads/1/3/0/7/130739883/xowurif_gudulovigopizam_lujezanosotoxoz_tipekaxi.pdf
    • http://wonderful-yoga.com/uploads/1/3/0/5/130590243/4ee89a48.pdf
    • http://riversidecountyhistory.org/uploads/1/3/0/2/130271113/130271113.html#legrand+4+way+switch+lowes

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012f9.bin
94bd2dba9f33fa7c5403611bf45218a1bb525a9ed4c3ca3125c9da5158283d1e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12F9 8688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.