Malicious PDF — malware analysis report

Static analysis result for SHA-256 028434736d474eff…

MALICIOUS

PDF

43.5 KB Authoring application: Poppler-utils
MD5: 57f6678632fe635aecaf1bf76bcec018 SHA-1: c21b1797cbe2714f8567952d0a9f6abbc443ae34 SHA-256: 028434736d474eff1ab571e1c10f55659f58c088b0857a97070823efff62ea76
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of embedded URLs pointing to other PDF files, suggesting a link farm or a distribution mechanism for further malicious content. The document body itself is largely unreadable but contains some of these URLs, indicating a potential phishing or SEO manipulation attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cmw522.com/uploads/1/3/0/5/130550743/gezepug.pdf
    • http://mekalanu.veronicaasorey.com/uploads/2020/01/27/vamedewerufudadi.pdf
    • http://wabashtees.com/uploads/1/3/0/5/130545827/loselinogubob.pdf
    • https://daturavez.weebly.com/uploads/1/3/0/4/130483397/f296a2caae.pdf
    • http://poxu.hotelimperiya.ru/uploads/2020/01/29/7132e1.pdf
    • http://alyssup.com/uploads/1/3/0/6/130620560/nubebofujezoroparak.pdf
    • http://fab.milopoo.com/uploads/2020/01/27/57c4dbf1384.pdf
    • https://bokizokepotuza.weebly.com/uploads/1/3/0/3/130324351/64a9959.pdf
    • http://mrssouthernsclass.com/uploads/1/3/0/2/130272616/5018163.pdf
    • http://mypuriumsambi.com/uploads/1/3/0/4/130490181/5956656.pdf
    • http://mindraym5.radiologyequipmentstore.com/uploads/1/3/0/6/130621305/pirikulew-xowurararu.pdf
    • http://littlethinkers.net/uploads/1/3/0/3/130323461/xivefudeduzi_selegog_lipir.pdf
    • https://xevikokesuma.weebly.com/uploads/1/3/0/5/130542859/5ad488f.pdf
    • http://mirrorsireland.com/uploads/1/3/0/5/130551882/wedanutolawu.pdf
    • http://3destate.ru/uploads/2020/01/27/zefavujizani.pdf
    • http://cityonloc.com/uploads/1/3/0/2/130270938/130270938.html#blitzwolf+bw-+fye5+manual+pdf
    • http://www.adobe.com/).Noto
    • http://www.google.com/get/noto/http://www.adobe.com/type/This
    • http://scripts.sil.org/OFLNoto

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001456.bin
c769922ff96fb8244cc4d7be27ee71634a3424fb6c64321e62f9f2a5758e70a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1456 9412 bytes
font_01_sfnt_off00006846.bin
ca01588ab367d85b4bf10f7c21f7e1627174e1ff9dc8f5fd04d6da1cc5bae6ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6846 4988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.