Malicious PDF — malware analysis report

Static analysis result for SHA-256 043949331fcc9c98…

MALICIOUS

PDF

48.7 KB Authoring application: PDFBox
MD5: f15d26e52804ec0e77228e63182ce830 SHA-1: e47cedb9c475840dc1a1e2aa1e06efd710c14153 SHA-256: 043949331fcc9c988435a339adde2bb88edf8fdc7838715b07f741da206a6265
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a mass external link farm, with many URLs pointing to other PDF files, suggesting a phishing or spam campaign. The document body, though partially corrupted, mentions a medical textbook download, likely a lure. The ClamAV detection and ML classifier strongly indicate malicious intent, likely to redirect users to malicious content or download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://e-wco.com/uploads/1/3/0/5/130588601/duzixiz_jofuvinuzu_jujakuvoresatef_notot.pdf
    • http://plantsexpress.com.au/uploads/1/3/0/7/130739751/7815263.pdf
    • http://wegubuwen.picsonair.com/uploads/2020/01/28/550495.pdf
    • http://renemogensen.net/uploads/1/3/0/4/130477890/dbacf4b.pdf
    • http://nzgirls.org/uploads/1/3/0/6/130621404/8507005.pdf
    • http://tlceducationalservices.com/uploads/1/3/0/6/130603709/704318.pdf
    • https://nadenoganeziwo.weebly.com/uploads/1/3/0/2/130270874/silox_dinagamawemi.pdf
    • http://jedrietveld.com/uploads/1/3/0/6/130639590/acccd9.pdf
    • http://jacksonbell.net/uploads/1/3/0/5/130550871/pizalaxo.pdf
    • http://erjica.site/uploads/1/3/0/6/130604544/sogux_fevijufesedub_tivekovodemuged_simokifunoleguj.pdf
    • http://nuohotel-zh.devsite-1.com/uploads/1/3/0/6/130639257/130639257.html#kumar+and+clark+clinical+medicine+9th+edition+download

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001316.bin
b388e215742a2dd8a6733bf90d571e0d7210474299f715a228014e95d2ea7b4c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1316 8932 bytes
font_01_sfnt_off000084bc.bin
83459e82cebe561b9e65dda6a09953c9e35f75e5df0fa62a624e1833cc5b8086		 pdf-font-stream PDF embedded font (sfnt) at offset 0x84BC 1708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.