Malicious PDF — malware analysis report

Static analysis result for SHA-256 05e224b86391e1b5…

MALICIOUS

PDF

38.5 KB Authoring application: Serif PagePlus
MD5: b87c666e87227d0c93cc921db8a2ac7e SHA-1: 5cff6814fce6bb5c048cd938dfd6134c2086b305 SHA-256: 05e224b86391e1b5a8bf322f20430bcd54b5d1e3ae3a9c7ace2e59bec9e5a8c0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a critical alert for a link farm containing 31 external PDF links, and a high-confidence ML classification. The embedded URLs likely lead to phishing sites or further malware. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://neahkahnieflintlocks.com/uploads/1/3/0/6/130604615/xofitezanuwe.pdf
    • http://dubaisolarcctv.com/uploads/1/3/0/5/130540134/tiveg.pdf
    • http://mrscooterrentals.net/uploads/1/3/0/4/130489763/9315482.pdf
    • http://makingmemorieswithscrapbooking.com/uploads/1/3/0/5/130539203/6315198.pdf
    • http://kwpetcarecypress.com/uploads/1/3/0/6/130604312/nijovemejulazuz_jujuze_vufumex.pdf
    • http://phoneduke.com/uploads/1/3/0/4/130477064/674489.pdf
    • http://nathantylerdavisfoundation.com/uploads/1/3/0/2/130289546/kerilunaluge_wuxemezexifuxo_jurimajosen_jepiga.pdf
    • http://cnymariancenter.net/uploads/1/3/0/6/130620788/3464899.pdf
    • http://beastedart.com/uploads/1/3/0/4/130435680/dizerapagaralapeda.pdf
    • https://dugixefola.weebly.com/uploads/1/3/0/4/130490421/2ba31bb.pdf
    • http://1ststitch.ca/uploads/1/3/0/5/130551671/wepadipifize-zifijim-zotizuzetutotu.pdf
    • http://ourcata.org/uploads/1/3/0/6/130640128/8430392.pdf
    • http://dominadomino.co.uk/uploads/1/3/0/5/130588934/limopugamujukenikek.pdf
    • http://centralbrowardtransitstudymeeting.com/uploads/1/3/0/3/130379289/e18a3f9d677.pdf
    • http://jasamopo.audiostart59.icu/uploads/2020/01/28/4e045cd18f62895.pdf
    • http://rati.moiklining.ru/uploads/2020/01/28/pekujapomajawes.pdf
    • http://saigonapartmentcenter.com/uploads/1/3/0/5/130550700/bec0e82292bd.pdf
    • http://newdawnbirthdoula.com/uploads/1/3/0/5/130588276/jovijubisemo_gelosaru.pdf
    • http://beautybybfm.com/uploads/1/3/0/6/130604562/495f4a995.pdf
    • http://simplyessentiallife.com/uploads/1/3/0/5/130550712/70ac9.pdf
    • http://craftfoodandwinefestival.com/uploads/1/3/0/6/130621592/03e0737b0b4a.pdf
    • http://informalatino.com/uploads/1/3/0/2/130289663/pifewe-fabibu-zudin.pdf
    • http://marketingforsalessuccess.com/uploads/1/3/0/4/130477026/67557.pdf
    • http://merrycollections.com/uploads/1/3/0/2/130272095/466037.pdf
    • http://miradorkitchenandhome.com/uploads/1/3/0/6/130621226/3393109.pdf
    • http://thehnossaproject.com/uploads/1/3/0/3/130323962/130323962.html#asus+prime+x370-pro+bios

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000195d.bin
19c1fa15acd8feb896a81392557abed01bb7fbc8627ae70826bf34530e0ad93a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x195D 8188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.