Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ab6331a01290622…

MALICIOUS

PDF

28.9 KB Authoring application: ImageMagick
MD5: 25f7d37d1d252ea0d2e54fcb10145d79 SHA-1: bc5a9385c4dd8de6aafb1a210dbc1fd0044a8cfd SHA-256: 7ab6331a012906228ba0d7682183c2fff57dd9d4d443f667feda0a6a34b91c4c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0 and a machine learning model indicated a high probability of maliciousness. The heuristic PDF_SEO_LINK_FARM firing confirms the presence of a large number of external PDF links, with musiccitypetpartners.net being the dominant host. The document body contains text related to 'Feeling songs telugu ringtones' and also embeds several URLs pointing to other PDF files, suggesting a phishing or content distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://musiccitypetpartners.net/uploads/1/3/0/6/130621892/sogerakag_xixipi.pdf
    • http://deluxehomestaging.com/uploads/1/3/0/5/130588716/texosavize-bamuzoj-japelej.pdf
    • http://one21i.com/uploads/1/3/0/2/130270887/xokexa-pegufimekinogef.pdf
    • https://riralikatuxu.weebly.com/uploads/1/3/0/3/130323116/2d8b6c4154c4fc.pdf
    • http://nurturingnursery.com/uploads/1/3/0/5/130547286/femubobaligodijimi.pdf
    • http://prettylittlewaistline.com/uploads/1/3/0/4/130483318/lanelesuvujujij.pdf
    • http://danadrakedesign.com/uploads/1/3/0/4/130435839/6787176.pdf
    • http://michellejestersite.com/uploads/1/3/0/6/130621836/59e7c3157e8ad51.pdf
    • http://absystemsllcscam.com/uploads/1/3/0/3/130313470/130313470.html#feeling+songs+telugu+ringtones

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000118b.bin
d5cb5e09a42d246d8951f1f85488945c7e3c911ad91f759978898dd898e17b57		 pdf-font-stream PDF embedded font (sfnt) at offset 0x118B 7416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.