Malicious PDF — malware analysis report

Static analysis result for SHA-256 851c9325058db216…

MALICIOUS

PDF

36.4 KB Authoring application: Inkscape
MD5: ba6972bdb6791a66e99e8e81b345ddd9 SHA-1: acf374a7514673c3bba8be49b5db073fb3db5d6e SHA-256: 851c9325058db2169407ed4ed4a4757c930bcca9e2c964e8eab116b63f735c55
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, suggesting a link farm designed to distribute malicious content. The heuristic 'PDF_SEO_LINK_FARM' and ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly indicate a phishing or malware distribution campaign. The document body, despite being heavily obfuscated, contains several of these URLs, reinforcing the link farm attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nazaretrealty.com/uploads/1/3/0/6/130604582/bd1aa781.pdf
    • http://standoutindallas.com/uploads/1/3/0/6/130640182/9668852.pdf
    • http://chipinc.org/uploads/1/3/0/3/130313228/4015414.pdf
    • http://accessconsciousness7day.com/uploads/1/3/0/4/130490585/gerodevuduwe.pdf
    • http://laura-cunningham.weebly.com/uploads/1/3/0/3/130323324/2263482.pdf
    • http://nationalrpoclinic.com/uploads/1/3/0/6/130639076/kepefalesisekotok.pdf
    • http://pazibarul.cabinet-otpbank.info/uploads/2020/01/29/gedelejewu_denupirurew_kemeso.pdf
    • http://tillercap.com/uploads/1/3/0/6/130639983/876697.pdf
    • http://rachaelcrossman.com/uploads/1/3/0/5/130540420/1a90b3c1.pdf
    • http://elpacifico2hoa.com/uploads/1/3/0/6/130603989/lojusala-winefazubano-jazifapufe-luvusuxugu.pdf
    • http://michellevp.com/uploads/1/3/0/6/130603807/wolajexum_raxeponodog_rerisuxapavari_misadexisubela.pdf
    • http://moodlabnewlife.nl/uploads/1/3/0/6/130640020/130640020.html#corrugated+zinc+sheet+dimensions

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001323.bin
cc056f6c1d8636dbb9ce6d82682fb42844d79dd5568160e048bd27a1c87446cd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1323 8312 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.