Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e6626318bcc5baa…

MALICIOUS

PDF

27.8 KB Authoring application: Inkscape
MD5: 6ecaa4871303119ffe8328d68a3ce892 SHA-1: 6b4849b3a7c838569485d467f4ea247659189a3a SHA-256: 7e6626318bcc5baa583828198360c58360194ec3ceb25a03b7735ec4f1af96c5
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document is identified as malicious by multiple heuristics and a machine learning classifier, specifically flagged as a phishing lure and a link farm. The document contains a screenshot designed to trick users into clicking embedded URLs, which lead to a large collection of other PDF files hosted on various domains. The embedded URLs suggest an attempt to manipulate search engine results or distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 27 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://merx-group.com/uploads/1/3/0/6/130622042/xivesaji-lipuxa.pdf
    • http://dcepool.net/uploads/1/3/0/7/130776067/lojopilosarizik.pdf
    • http://redtopdesigns.com/uploads/1/3/0/6/130604627/lowudof-xaxon.pdf
    • http://1cafedumarche.ch/uploads/1/3/0/4/130483477/9e886ee31c91.pdf
    • http://tripbuys.com/uploads/1/3/0/6/130605471/2903547.pdf
    • http://appraisalprogroup.com/uploads/1/3/0/6/130621651/1013021.pdf
    • http://mybenstratton.com/uploads/1/3/0/2/130273788/fiwaxon_linufomogu_kosibuvu.pdf
    • http://getleanwithmaureen.com/uploads/1/3/0/4/130476277/7727201.pdf
    • http://simplycfood.com/uploads/1/3/0/6/130620532/pirixir-perawujik.pdf
    • http://cincottalaw.com/uploads/1/3/0/8/130874316/cd7efe4.pdf
    • http://knit1chicago.com/uploads/1/3/0/7/130775462/6687494.pdf
    • http://gardendivafashions.com/uploads/1/3/0/8/130814085/dixifoz.pdf
    • http://cerecdl.com/uploads/1/3/0/2/130288378/sazik.pdf
    • http://alisonyinblog.com/uploads/1/3/0/2/130292007/zulejufe.pdf
    • http://satvikshukla.com/uploads/1/3/0/8/130874197/lelabuvuvuvoje_gilapata_kukisibiw.pdf
    • http://hta2.com/uploads/1/3/0/7/130739098/tilone-giwovexow-kobelojegu-futibilig.pdf
    • http://futuresnetwork.org/uploads/1/3/0/5/130539225/vavonorezibixo-zinuril-zenunubar.pdf
    • http://host67.carmichaelnl.com/uploads/1/3/0/4/130478106/130478106.html#namaz+parhne+ka+sahi+tarika+in+urdu+video

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000170c.bin
10e2721025614326927dd7e737e4e9612583bcb53faaa06c19c92d88b95b009a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x170C 5260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.