Malicious PDF — malware analysis report

Static analysis result for SHA-256 ffd61a9ee283e20f…

MALICIOUS

PDF

45.8 KB Authoring application: GIMP
MD5: 39ecf126524e105e9f96a050f25caa9e SHA-1: ffd1fd079a870582e928e669ae8d35c422e8e771 SHA-256: ffd61a9ee283e20f4d03e5eab1ff82ad3264f0aab0552bb3bb18460f58fb4f2d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The critical PDF_SEO_LINK_FARM heuristic indicates the presence of a large number of external links, with the first identified URL being http://ctmpropertymanagementsc.com/uploads/1/3/0/8/130813652/defowuxofafagos.pdf. This suggests the document's primary purpose is to lure users to external sites, likely for phishing or malware delivery.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ctmpropertymanagementsc.com/uploads/1/3/0/8/130813652/defowuxofafagos.pdf
    • http://centerofsacredpassage.com/uploads/1/3/0/7/130776326/bagip_nixifebipivez.pdf
    • http://www.sorteincorporation.co.za/uploads/1/3/0/4/130483918/xiduzuledoxu_dowokigolik_kegesunumi_fegugan.pdf
    • http://highsolaris.com/uploads/1/3/0/4/130435884/9d6b17dc6080ef.pdf
    • http://mydearestbaby.com/uploads/1/3/0/5/130540049/03fa332e8a87.pdf
    • http://jingchengguojiyulechengzaixianbocai.f18.ebkf.org/uploads/1/3/0/7/130739000/ebbc5f75d.pdf
    • http://reisebasar.ch/uploads/1/3/0/6/130639509/982e64.pdf
    • http://rose-from-concrete.com/uploads/1/3/0/6/130604700/padudubexumutev.pdf
    • http://facilitatingleaders.org/uploads/1/3/0/6/130621089/nasogedeziti.pdf
    • http://www.kimz-kreations.com/uploads/1/3/0/3/130379959/8762872.pdf
    • http://treehousehashomes.com/uploads/1/3/0/6/130621643/206d111bd182.pdf
    • http://ugomicci.it/uploads/1/3/0/5/130547515/8ab3d6dd.pdf
    • http://prettylittlethings.ca/uploads/1/3/0/7/130775376/jaxafojaluzazipamek.pdf
    • http://keithwardfiction.com/uploads/1/3/0/7/130776826/kaxugiv_razunewatema_rerejiso_nipimiri.pdf
    • http://sederholms.net/uploads/1/3/0/6/130621754/6ce515e.pdf
    • http://www.alycesmithhair.com/uploads/1/3/0/5/130539074/3303431.pdf
    • http://www.bjwoodtx.com/uploads/1/3/0/6/130604958/5589b0c1bb6719c.pdf
    • http://ottica2g.com/uploads/1/3/0/7/130740483/suragawopejuwew.pdf
    • http://metaprotection.com/uploads/1/3/0/7/130775292/xowadezibazobi.pdf
    • http://eye-of-awareness.com/uploads/1/3/0/2/130270980/2beac.pdf
    • http://calhouncountywaspsandflies.org/uploads/1/3/0/2/130291694/8078494c2d.pdf
    • http://www.callan.fyi/uploads/1/3/0/6/130639344/130639344.html#scary+pumpkin+carving+patterns+free+printable+stencil

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005012.bin
97438e3abca5808f30ebb3f4d911c6700b1842dd66fe3587aa22473d2d316e29		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5012 8936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.