Malicious PDF — malware analysis report

Static analysis result for SHA-256 bea934811579f4e9…

MALICIOUS

PDF

33.4 KB Authoring application: Inkscape
MD5: ef546779e4d3d14ad0aacd9c728ccf86 SHA-1: b799c48eaeda29e74465d096000791e7f603b065 SHA-256: bea934811579f4e9d10faae102fdeca2bed9a0d3c5cd66dc9977cd4e87e160dd
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, many of which point to other PDF files hosted on various domains. This behavior is indicative of a link farm or a phishing lure designed to redirect users to malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing classification. No scripts were extracted from this sample, but the embedded URLs are the primary indicators of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stonesoaps.com/uploads/1/3/0/6/130639285/vidivof.pdf
    • http://mytextsandhumanexperiences.com/uploads/1/3/0/5/130551696/162f40f.pdf
    • http://incartix.net/uploads/1/3/0/5/130538922/ladolusigimaxija.pdf
    • http://baigoftricksentertainment.com/uploads/1/3/0/5/130540725/jogani_sajizizi.pdf
    • http://wearebienchula.com/uploads/1/3/0/4/130492889/xusowinu.pdf
    • https://wetumebuniw.weebly.com/uploads/1/3/0/4/130435902/562e534b45.pdf
    • http://mapsomething.com/uploads/1/3/0/5/130540823/mixifapebukodifud.pdf
    • http://marecjoyce.lighting/uploads/1/3/0/2/130289553/709f68a08b1bb.pdf
    • http://hello-baby-toys.com/uploads/1/3/0/6/130620406/130620406.html#relative+clauses+worksheets+year+5

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000116d.bin
3b2606fce179ab9ede6f5b5519537d23f75535aaa0fff6fb9617a799fd37b115		 pdf-font-stream PDF embedded font (sfnt) at offset 0x116D 7808 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.