Malicious PDF — malware analysis report

Static analysis result for SHA-256 8166f29dee3ea513…

MALICIOUS

PDF

51.6 KB Authoring application: ImageMagick
MD5: 6f4878e05ab8b69e4100f8af36f0939b SHA-1: d329604c068df41d8c1fdc48fa61f390abb6d708 SHA-256: 8166f29dee3ea513c995159688a63f688b24ccba2a5231241c7eca80901b1022
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, indicating a link farm or redirection strategy. ClamAV detected this as Pdf.Phishing.TtraffRobotInstall, and a machine learning classifier also flagged it as malicious. The embedded URLs are the primary IOCs, suggesting the document's purpose is to drive traffic to these external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://orchardstar.us/uploads/1/3/0/2/130270977/guzasizumej.pdf
    • http://www.austintxtherapists.com/uploads/1/3/0/4/130491063/tageren.pdf
    • http://oscarthedumpertruck.com/uploads/1/3/0/5/130588206/3955543.pdf
    • http://metairielaw.com/uploads/1/3/0/4/130436473/larifozawige.pdf
    • http://jrrstott.net/uploads/1/3/0/7/130740044/levonokonelaz.pdf
    • http://bitcoinexchange.net/uploads/1/3/0/2/130289510/9372b4de1.pdf
    • http://ezparkwalk.com/uploads/1/3/0/5/130551925/3188836.pdf
    • http://sammalonesblog.com/uploads/1/3/0/6/130639192/mubupaworinip-zovopudu.pdf
    • http://goldendealusa.com/uploads/1/3/0/6/130640101/vojab_gufologe.pdf
    • http://adventuristatravel.org/uploads/1/3/0/8/130874051/5744932.pdf
    • http://ashleychristina.com/uploads/1/3/0/8/130873843/fd5e2.pdf
    • http://pierviewcoffee.net/uploads/1/3/0/6/130620455/nobesosevine-dugovov-mamulutavapa.pdf
    • http://morris-auto.com/uploads/1/3/0/4/130476342/notuviziwe-dareta-lewabavik-visofodufotoma.pdf
    • http://louromartinsadvogados.pt/uploads/1/3/0/5/130546538/8ff9a871fa.pdf
    • http://www.bridgecreditconsulting.com/uploads/1/3/0/4/130489001/segibitiwikuzuki.pdf
    • http://politicalethnographyproject.org/uploads/1/3/0/5/130588876/dedotixatavof.pdf
    • http://monicacarrollart.com/uploads/1/3/0/5/130551181/mevikob_todob_zepeji.pdf
    • http://advokat-moscow24.site/uploads/1/3/0/7/130775015/lifojirusimiv.pdf
    • http://justamotherblog.com/uploads/1/3/0/6/130639729/4382332.pdf
    • http://alexisarenas.com/uploads/1/3/0/5/130588857/1f92a617d2b39e.pdf
    • http://autodiscover.jacquelineclewis.com/uploads/1/3/0/3/130313339/130313339.html#does+fermentation+require+glycolysis

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001456.bin
00cee2c5e09f375751cba39bd44c34e9cf1bb1eaacd0df08d1020fb7f8e572f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1456 8972 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.