PDF malware analysis — malicious · c05e244511fcb14a

MALICIOUS

PDF

44.6 KB Authoring application: ImageMagick

MD5: 343a5f14de3ee01bb6a29786aa2ff3c4 SHA-1: 9428fb5e47319bbf97773a2111f8e5a694fe5423 SHA-256: c05e244511fcb14a7014fa2a2a7e6d92fec734da28c1a031564195719b7324f3

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, aligning with the PDF_SEO_LINK_FARM heuristic. No scripts were extracted from this sample.

Machine Learning

Nyx PDF Classifier malicious score 0.9996

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://v-aria.com/uploads/1/3/0/5/130551000/c3dd39577.pdf
- http://www.thecurtisstuckey.com/uploads/1/3/0/5/130543240/tigamelu_rijasa.pdf
- http://amckbc.com/uploads/1/3/0/6/130622025/330dbcc.pdf
- http://globalproportions.com/uploads/1/3/0/5/130550657/xemawezifulof-wotadajuxeri.pdf
- http://fromper.com/uploads/1/3/0/7/130738812/supeg.pdf
- http://burlingtonsquaremanchester.net/uploads/1/3/0/7/130775649/kikakijexix.pdf
- http://www.professorwilliamthomas.com/uploads/1/3/0/6/130620228/5e15f316c2880.pdf
- http://turkeyvilla.info/uploads/1/3/0/4/130476563/0ecce0b439.pdf
- http://tactical-valkyrie.com/uploads/1/3/0/5/130551226/1752895.pdf
- http://empire-equestrian.co.uk/uploads/1/3/0/8/130874613/tagadi.pdf
- http://nnetherland.com/uploads/1/3/0/4/130476678/panoza.pdf
- http://noworries-caretakers.com/uploads/1/3/0/6/130605387/zitewepisaxegos_sifinona.pdf
- http://yessicafandinofiore.com/uploads/1/3/0/6/130639933/zemixosupo-vusuba.pdf
- http://andamiaoficial.com/uploads/1/3/0/6/130604448/gideribo.pdf
- http://paradoxical-reality.net/uploads/1/3/0/7/130776088/4178110.pdf
- http://carolinaboardandbowl.com/uploads/1/3/0/6/130621335/8515444.pdf
- http://allancapital.ca/uploads/1/3/0/4/130436190/rusozatodunato_tezumugotiwidar_golesibezi.pdf
- http://spokanesultimatemodel.com/uploads/1/3/0/2/130289096/rekelurovunuxiba.pdf
- http://meridiannow.com/uploads/1/3/0/2/130273576/puguwiwedikolobekepo.pdf
- http://zuada.org/uploads/1/3/0/6/130620371/8933581.pdf
- http://scriptureboxes.com/uploads/1/3/0/8/130874163/mupijipose.pdf
- http://project-otaku.com/uploads/1/3/0/5/130544494/d53b9cf.pdf
- http://verosoup.com/uploads/1/3/0/2/130270804/bipaw-vekutuve-povut.pdf
- http://britanygraceinterioirs.ca/uploads/1/3/0/2/130288629/vewudotuvivinejevavi.pdf
- http://contadores-auditores.com/uploads/1/3/0/2/130272424/130272424.html#advertising+industry+in+india+2019+pdf
- http://noworries-caretakers.com

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000031cb.bin` `32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x31CB	16164 bytes
`font_01_sfnt_off000049aa.bin` `63109e77da3a93b60f5b2ba118de1bb5a0dff78121a3b2b2faad29b6dd8748a4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x49AA	8424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.