Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab330f5ae8ba352e…

MALICIOUS

PDF

38.0 KB Authoring application: Inkscape
MD5: 26729707312745089b0e50e46d130684 SHA-1: 206df2b635878dca5059efd7ca4c849f3e4a7c2b SHA-256: ab330f5ae8ba352e4da991aeed983c5fd80fb95e92358d91a41cd6bfcc6b9b5a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute malicious payloads. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of a link farm, suggesting the document's primary purpose is to redirect users to external content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.predetroit.com/uploads/1/3/0/5/130543366/61d1263c.pdf
    • http://dvmlibrary.com/uploads/1/3/0/6/130605373/lariwa.pdf
    • http://alhidaayah.greatwebsitebuilder.com/uploads/1/3/0/7/130776299/pototolenupalagopuw.pdf
    • http://naturalbalancetherapies.org/uploads/1/3/0/4/130436093/496e31e2ba53.pdf
    • http://newhorizonsllchardwoodscustomprofiles.com/uploads/1/3/0/4/130483940/xitujomikezus.pdf
    • http://sterlingheights.christmas/uploads/1/3/0/3/130379357/lirosarira-jekowufokin-benawezef-pitodi.pdf
    • http://bdcglobalpng.com/uploads/1/3/0/7/130739180/difijexewi.pdf
    • http://netmagnetism.ca/uploads/1/3/0/8/130874629/vatifowisowekep.pdf
    • http://www.bearwallowumc.com/uploads/1/3/0/7/130775979/samudekajo.pdf
    • http://przyczepa.com/uploads/1/3/0/4/130483551/4366816.pdf
    • http://mandyfitzgerald.com/uploads/1/3/0/4/130476102/1419477eb7b.pdf
    • http://ramosironworks.net/uploads/1/3/0/6/130621757/tajerivobuwokilana.pdf
    • http://admin.seranto.co.uk/uploads/1/3/0/5/130544313/bowineju_midifovebag.pdf
    • http://morganadvisorygroup.com/uploads/1/3/0/2/130270793/054dfec1.pdf
    • http://mrfleischer.com/uploads/1/3/0/3/130379604/031e1a.pdf
    • http://marenhenson.com/uploads/1/3/0/5/130541077/xerigepopaxoxiwi.pdf
    • http://ingridsolbrig.com/uploads/1/3/0/7/130776408/bikokigipepumem.pdf
    • http://www.seminalra.com/uploads/1/3/0/4/130436079/torikenagewuma-safujizali.pdf
    • http://scottmcquillin.ca/uploads/1/3/0/6/130603702/130603702.html#non+verbal+reasoning+test+for+8+year+olds+pdf
    • http://naturalbalancetherapies

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000357b.bin
6146e4e7a72fbc03701dd02aa5ea1e0e958bb92000b3d07d6aecb993b7490d51		 pdf-font-stream PDF embedded font (sfnt) at offset 0x357B 8348 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.