PDF malware analysis — malicious · ba7995b151328eae

MALICIOUS

PDF

61.8 KB Authoring application: Inkscape

MD5: eee4f28e9d9c1e47b6c238d31e90573f SHA-1: 776f144ef0a979bab9f75dce832c510b9e464aab SHA-256: ba7995b151328eae3373d262d17edbfe8c61cf244a7ebd1b401c612b5e52472f

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files, indicating a link farm or SEO poisoning tactic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly suggest malicious intent. The primary goal appears to be directing users to a network of potentially malicious sites through these numerous links.

Machine Learning

Nyx PDF Classifier malicious score 0.9997

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://newnextsf.com/uploads/1/3/0/7/130776607/5dd44.pdf
- http://mohnayminks.com/uploads/1/3/0/5/130550729/2141988.pdf
- http://bankruptcyattorneycapecoral.org/uploads/1/3/0/6/130604519/9345901.pdf
- http://qqblog.net/uploads/1/3/0/6/130604433/b46d09.pdf
- http://relst-uhag66.com/uploads/1/3/0/8/130873975/zikemopo-besumavofiwiz-valevome.pdf
- http://askthetutor.ca/uploads/1/3/0/7/130738884/58e4f7bb2645ecb.pdf
- http://ms-j.org/uploads/1/3/0/7/130775679/detezarafil.pdf
- http://handipapers.com/uploads/1/3/0/5/130588675/4db47fd.pdf
- http://research-usa.com/uploads/1/3/0/2/130291910/e976a51149685.pdf
- http://palestinefashions.com/uploads/1/3/0/4/130476403/3c0f4.pdf
- http://nabroad.org/uploads/1/3/0/7/130775513/vigatuzokax_rodew.pdf
- http://kswinehk.com/uploads/1/3/0/2/130289493/nonevexur.pdf
- http://iconftx.com/uploads/1/3/0/5/130551248/d037d.pdf
- http://dmnroundtable2020.com/uploads/1/3/0/4/130483863/6864858.pdf
- http://naturalbirthingjoy.com/uploads/1/3/0/5/130588611/wunojatotan-gukofegokulutup.pdf
- http://merrycollections.com/uploads/1/3/0/6/130639879/943802.pdf
- http://verticalfitness100.com/uploads/1/3/0/4/130477309/6290460.pdf
- http://workone.info/uploads/1/3/0/4/130478819/wunewageje_zixogox.pdf
- http://pitchstock.net/uploads/1/3/0/4/130489465/9574551.pdf
- http://phondo.com/uploads/1/3/0/4/130483110/xamivezunajabip.pdf
- http://www.royalstalkcrew.com/uploads/1/3/0/4/130436188/4e985cf90459.pdf
- http://cr9.io/uploads/1/3/0/4/130483811/dowezakaja.pdf
- http://trinityplantsale.com/uploads/1/3/0/5/130540795/xizagivuje.pdf
- http://nonconformist0.pleasingfood.com/uploads/1/3/0/8/130814279/130814279.html#somewhere+over+the+rainbow+what+a+wonderful+world+israel+kamakawiwo+ole+mp3+download

Extracted artifacts 3

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000010a6.bin` `6452c5a6f6e928751bf8cff1e448fb1d0e7cca776999d692a65672bc6296754d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x10A6	9336 bytes
`font_01_sfnt_off00008de6.bin` `2c32c498f23db3cae400dac070c72b38d41a5d5dbe5041cbe08e7cee44e1acfd`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x8DE6	2648 bytes
`font_02_sfnt_off000096e8.bin` `e15e0af66b977530f6e30cf38c2dd441c7d9891a5363db17e21afab5cd3caeb8`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x96E8	16740 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.