Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6e7d55e7e6dc8e0…

MALICIOUS

PDF

41.3 KB Authoring application: GIMP
MD5: 034e7b4dfe8d11e2b587b3a1257e7802 SHA-1: b7af583b0eeadef0541ece390da8a9abecb1e768 SHA-256: a6e7d55e7e6dc8e074bc567bcec7e4ee6455534590772c2359ccdf429ea9c213
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing:Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to other PDF files hosted on various domains, indicating a link farm or redirection strategy. ClamAV detected this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', and ML classification strongly supports maliciousness. The primary attack pattern involves directing users to a multitude of external PDF resources, likely for SEO manipulation or to serve as a distribution point for further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://infinitespinners.com/uploads/1/3/0/7/130776103/sukejon-didurub-kojeb.pdf
    • http://windowssavvy.com/uploads/1/3/0/2/130271043/0233ef6770cfb1.pdf
    • http://doublekdorpersheepranch.com/uploads/1/3/0/6/130621507/051b010b4.pdf
    • http://cocorosaemporium.net/uploads/1/3/0/4/130488328/5828396.pdf
    • http://thescoreshop.ca/uploads/1/3/0/3/130323178/8458357.pdf
    • http://scarlettsloanewalling.com/uploads/1/3/0/7/130776673/3240675.pdf
    • http://warwickcarriagedriving.com/uploads/1/3/0/2/130272892/ee724fe8b.pdf
    • http://tqcontentcrusader.com/uploads/1/3/0/2/130291635/wujemugewutu.pdf
    • http://aquariumboss.com/uploads/1/3/0/7/130775572/muvupunatoropadobeju.pdf
    • http://edengiftco.com/uploads/1/3/0/5/130539078/43336a3da9.pdf
    • http://caninecocktailpawty.com/uploads/1/3/0/5/130551235/vigurulabeg-walolaxejolasip-gidenup.pdf
    • http://webmail.tambourunite.com/uploads/1/3/0/2/130271240/govoxekakujebareruke.pdf
    • http://equineartworks.com/uploads/1/3/0/2/130272318/gekafunifotoretazi.pdf
    • http://www.phecurrency.com/uploads/1/3/0/3/130313198/9782693.pdf
    • http://luxseek.com/uploads/1/3/0/7/130738970/pabifebinis.pdf
    • http://lilyspadpetcare.com/uploads/1/3/0/3/130313638/rosar_tixazadufojaw_jematidibede.pdf
    • http://themountainforge.com/uploads/1/3/0/7/130776541/1d1952f.pdf
    • http://shot-sleeves.com/uploads/1/3/0/7/130739124/7aeac1ba.pdf
    • http://experiencemeaning.com/uploads/1/3/0/2/130289485/6838331.pdf
    • http://msbr.ca/uploads/1/3/0/4/130436367/solopezo-faxawemazojufas-kelukamadepipa.pdf
    • http://bozhidaoyulechengguanwang.br3h.com/uploads/1/3/0/4/130483576/130483576.html#atkins+diet+breakfast+cereal
    • http://windowss

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004099.bin
ddfa53f58a5fc987f92351b73b41da3c8c8da3f78e0567b483930a79cb42fdeb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4099 8396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.