Malicious PDF — malware analysis report

Static analysis result for SHA-256 968a8c00c33abee9…

MALICIOUS

PDF

38.9 KB Authoring application: Inkscape
MD5: e99143cef42dad0eba0b9087267dfd60 SHA-1: 948aead6171615f7aa538c5a106b6e5d8ff715a2 SHA-256: 968a8c00c33abee9da89c43f11d40469f9f2026c66d62b377a4e7c373d622d8a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule indicating a mass of external links. ClamAV also detected it as Pdf.Phishing.TtraffRobotInstall. The embedded URLs, despite some being marked as benign, are part of a larger link farm structure, suggesting a phishing or malware distribution attempt. The document body contains garbled text but also lists several URLs, reinforcing the link farm observation.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://jixuzorekorumum.weebly.com/uploads/1/3/0/5/130551144/tuberivukubib-nilugo-gajogad.pdf
    • http://shanahanagency.com/uploads/1/3/0/5/130542770/0f57c.pdf
    • https://kizumerubofev.weebly.com/uploads/1/3/0/5/130540211/2753883.pdf
    • http://agrotel.ch/uploads/1/3/0/2/130270905/makivasuzuwijabuj.pdf
    • http://dezandrob2018.com/uploads/1/3/0/4/130436367/690272.pdf
    • http://brandsview.com/uploads/1/3/0/6/130639192/lunenupokesa.pdf
    • http://moonshot.games/uploads/1/3/0/3/130379431/todugaminod.pdf
    • http://nilos.onemagazin.ru/uploads/2020/01/28/punegobomoteru-dijutoxazo-jivabe-rined.pdf
    • http://norecordsnobs.com/uploads/1/3/0/5/130540134/xurajumiwoxof_xajoma_vuvifalexon_lufasegipunugas.pdf
    • http://led.begettest15.fun/uploads/2020/01/28/2d7b8f42.pdf
    • http://carlowtennis.weebly.com/uploads/1/3/0/6/130639110/fogipevale-bududud-dilajodowa-sixepefo.pdf
    • http://gowiton.rossip.ru/uploads/2020/01/28/5324570.pdf
    • https://tafawunofotala.weebly.com/uploads/1/3/0/5/130590051/3600432.pdf
    • http://pinotnoiro.com/uploads/1/3/0/5/130550834/6a7c066a.pdf
    • http://registrationdogpapers.com/uploads/1/3/0/5/130550980/wakonusofonoziz-jojapa.pdf
    • http://bof.nasdwkas.icu/uploads/2020/01/27/lezinegakira.pdf
    • http://a1412531xstreamtravel.xsideas.com/uploads/1/3/0/4/130483606/130483606.html#pdf+auditing+and+assurance

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000014d0.bin
c9448b23e7047e9b01820c372ab724a323d70ad07a515ae3a2d7e217071b800c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14D0 8100 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.