Malicious PDF — malware analysis report

Static analysis result for SHA-256 6fb7c05812336b79…

MALICIOUS

PDF

35.0 KB Authoring application: Inkscape
MD5: a60b58b7df9abece399b3c45f6fc86c0 SHA-1: 959164804eadadd597c378ffff0f25fa79bb5df1 SHA-256: 6fb7c05812336b79aff8c368153cc53cce309f83152240af62293a330b26a2db
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a mass of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a malicious intent to manipulate search engine results or distribute further malware. The ML_NYX_PDF_MALICIOUS and ClamAV detections confirm the malicious nature of the file. The embedded URLs are the primary indicators of compromise, likely serving as distribution points for malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stonehouserealestate.info/uploads/1/3/0/5/130551202/a71b5b26f6dd.pdf
    • http://htwitoart.com/uploads/1/3/0/7/130776085/7286014.pdf
    • http://ilostmystuff.net/uploads/1/3/0/4/130436362/3352537.pdf
    • http://thefarmandco.com/uploads/1/3/0/8/130874497/zivuxid.pdf
    • http://midassnapshot.com/uploads/1/3/0/6/130639327/2dd9c8.pdf
    • http://smallstuff.info/uploads/1/3/0/3/130324419/3128125.pdf
    • http://knowledgelord.com/uploads/1/3/0/5/130545884/915e361390294.pdf
    • http://www.housepaintingdeals.com/uploads/1/3/0/5/130546385/d01e4ae683de.pdf
    • http://trtidalwave.com/uploads/1/3/0/4/130483447/latowejopogise.pdf
    • http://nharmonycastingandtalent.com/uploads/1/3/0/4/130483741/vidibebakon.pdf
    • http://tek-n.com/uploads/1/3/0/4/130488934/godurokagis-dobizowevox.pdf
    • http://nangreypottery.com/uploads/1/3/0/6/130621701/wemorova.pdf
    • http://readingrescuetalk.com/uploads/1/3/0/6/130620435/d7d46.pdf
    • http://74-123-73-95.mgwnet.com/uploads/1/3/0/6/130604856/130604856.html#tefal+actifry+recipes+roast+potatoes

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f60.bin
e1ebc0fb510e6a236251b139f1fee9412538de060af52cd8406db3d122c5d831		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F60 8160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.