Malicious PDF — malware analysis report

Static analysis result for SHA-256 08d7826e65d0ba5a…

MALICIOUS

PDF

35.6 KB Authoring application: PDFedit
MD5: 00f25b17a98455cbd44ea11089a5f2c6 SHA-1: a1a19b47c49e6a7e7f71255d5459db92346b25ca SHA-256: 08d7826e65d0ba5a018e9064b42fdb810d35b1bb89197dd792a6930230cf94ab
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is identified as malicious by multiple heuristics and a machine learning classifier, specifically flagged as a phishing lure related to a password-protected archive. It contains a large number of embedded URLs, suggesting it is part of a link farm designed to redirect users to malicious content. The document body, though truncated, contains references to a garage door manual and includes numerous URLs, reinforcing the phishing lure and the link farm attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://peoriatraditionalboosterclub.com/uploads/1/3/0/5/130588451/febajojuxij.pdf
    • http://pcbchain.co.uk/uploads/1/3/0/4/130483447/mojavenogiwi.pdf
    • http://tried-by-fire.com/uploads/1/3/0/6/130604304/59bfc4fcc307ec.pdf
    • http://logexu.coin-fishing.fun/uploads/2020/01/28/d7c4fea4.pdf
    • http://ophsclassof1999.com/uploads/1/3/0/3/130379354/2690231.pdf
    • http://itldo.net/uploads/1/3/0/6/130620869/1275296.pdf
    • http://burscoughpc.co.uk/uploads/1/3/0/2/130271142/f5d726c.pdf
    • http://solid-liquid-gas.weebly.com/uploads/1/3/0/4/130490444/6bae4504bc4.pdf
    • http://plataformaciudadana.net/uploads/1/3/0/7/130739894/76383f24.pdf
    • http://cocktailsexpress.com/uploads/1/3/0/7/130739221/2784949.pdf
    • http://stand2serve.net/uploads/1/3/0/6/130639872/fegazanemotul.pdf
    • http://northernrailleaders.com/uploads/1/3/0/5/130541384/130541384.html#chamberlain+garage+door+manual+41d7675

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000129c.bin
bb25560264fe5a0518642ee42477981ea0e39f7dea9d382bdc59c52bf6a1cf4c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129C 8568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.