Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ed1568943b69e1d…

MALICIOUS

PDF

36.4 KB Authoring application: GIMP
MD5: 2aa285045cc184b5bdb4ae6ab615beda SHA-1: 425001a5d40e2d249b336ee501a5efce7077cdc3 SHA-256: 7ed1568943b69e1de86b83c37f9ed2ac75b43eaa8d291051bbd427bf872c0ebd
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links to other PDF files, disguised as a "Canada visa form". This heuristic, combined with ClamAV detection and ML classification, strongly suggests a phishing or malware distribution campaign. The embedded links likely lead to further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://makercenterusa.com/uploads/1/3/0/2/130271031/silexag.pdf
    • http://smimarketingservices.com/uploads/1/3/0/3/130379216/vewidazarodob_mudelilaranoj.pdf
    • http://sevencedarsdesign.com/uploads/1/3/0/6/130621985/sitade-wunixi-fowemowemuni.pdf
    • http://momsofzion.com/uploads/1/3/0/6/130639958/tudakoverezatop.pdf
    • http://nwabaseball.com/uploads/1/3/0/4/130476144/sadasoba_dipurelek.pdf
    • http://newcenturyplayers.com/uploads/1/3/0/5/130588328/d7756bf5a17b.pdf
    • http://theavamari.com/uploads/1/3/0/2/130272385/fuzegegozawud.pdf
    • http://kaukauproductions.com/uploads/1/3/0/4/130488543/bd3e4263e9ad161.pdf
    • http://nataliekfitness.com/uploads/1/3/0/6/130604025/4566949.pdf
    • http://mike4congress.com/uploads/1/3/0/5/130546432/1586739.pdf
    • http://luckyrabbiteditions.com/uploads/1/3/0/6/130622084/42819690.pdf
    • http://pct4career.com/uploads/1/3/0/6/130639559/130639559.html#canada+visa+form+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000129b.bin
f51b3a06e283cbf2c374046adaf1e888019f902eced8a7eee3084bcf80b6c1ec		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129B 8428 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.