Malicious PDF — malware analysis report

Static analysis result for SHA-256 f00d9afbc6c08745…

MALICIOUS

PDF

37.7 KB Authoring application: GIMP
MD5: 99052d56e91b1dbf2c88cabc0c07f905 SHA-1: a6f6026f75563114f6a94076170ec0f77693acdb SHA-256: f00d9afbc6c087455e9312ccef260e62ab7ef25dce5d7581045618f7b4c8296d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection scheme. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or traffic-generating intent. The document body, though partially corrupted, contains keywords like 'Halloween worksheets 1st grade free' which may serve as a lure to disguise the malicious nature of the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mindfuldemocracy.org/uploads/1/3/0/5/130588960/8524718.pdf
    • http://brittanygrahamrealestate.com/uploads/1/3/0/2/130291545/5401292.pdf
    • http://mysticthisweek.com/uploads/1/3/0/4/130475979/xoruretutowudebu.pdf
    • http://commongroundsphilly.com/uploads/1/3/0/5/130588382/739697084d.pdf
    • http://risewithonyx.com/uploads/1/3/0/5/130539922/7285522.pdf
    • http://mk-acupuncture.com/uploads/1/3/0/7/130739621/5082957.pdf
    • http://trevornewtonartist.com/uploads/1/3/0/6/130621901/bukogawipudofapiro.pdf
    • http://photosbysarahtucker.com/uploads/1/3/0/5/130588957/mukaxop_tabame_tenijebiwowef_joxamub.pdf
    • http://norcalactive.org/uploads/1/3/0/5/130539350/35d74fc435974a.pdf
    • http://blockchainambassador.ca/uploads/1/3/0/3/130323979/130323979.html#halloween+worksheets+1st+grade+free

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001228.bin
11f691a4b21a05f63be05e66dc668b19e4f2cf18054ecdd4d6d661176c720e89		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1228 8088 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.