Malicious PDF — malware analysis report

Static analysis result for SHA-256 0a20cc3beb991123…

MALICIOUS

PDF

36.7 KB Authoring application: PDFedit
MD5: 5931ccc29421d5c51bdf815737f7a49a SHA-1: a917266d2dbb194c8ddfb0d3efe872526b52a9d3 SHA-256: 0a20cc3beb9911231f0aac1bee1ce2f970b3c6cce525b6a1091d007c939c79d5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a critical finding for a large number of embedded external PDF links. The ML classifier and ClamAV also identified it as malicious, specifically as a phishing or redirector. The embedded URLs likely lead to further malicious content or phishing pages, indicating a campaign to lure users to compromised sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://alessiadana.com/uploads/1/3/0/4/130435631/5787713.pdf
    • http://www.rimeelevate.com/uploads/1/3/0/6/130640109/jijigipa-ninumewizexaru-vozefu.pdf
    • http://michianawomeninconstruction.com/uploads/1/3/0/4/130483552/peduzulu.pdf
    • http://muso101.com/uploads/1/3/0/2/130287536/89ffa.pdf
    • http://crossfitswage.com/uploads/1/3/0/6/130605447/6425986.pdf
    • http://sugarmommascookieco.com/uploads/1/3/0/7/130740455/5a11df5a.pdf
    • http://reqbid.com/uploads/1/3/0/6/130604125/40796.pdf
    • http://katenkonijn.eu/uploads/1/3/0/5/130545021/kavazo_jivap.pdf
    • http://banqueuniverselle.net/uploads/1/3/0/6/130639573/9fa9e99dcf459.pdf
    • http://benkregel.com/uploads/1/3/0/6/130640084/1157247.pdf
    • http://finanzschule.info/uploads/1/3/0/5/130588621/8329584.pdf
    • http://spiritchile.net/uploads/1/3/0/6/130640181/1289501.pdf
    • http://3mdentallab.com/uploads/1/3/0/2/130289291/xurigizujeko_lusuvajonakaf_xibunul.pdf
    • http://northhaledontreeexperts.com/uploads/1/3/0/2/130289436/sovufuvibogelonas.pdf
    • http://chriswongfitness.com/uploads/1/3/0/7/130776037/7eb2489.pdf
    • http://sikhcanadians.com/uploads/1/3/0/3/130313388/demakivimokufed_gibufuwoje_jisubud_zazigu.pdf
    • http://host94.carmichaelnl.com/uploads/1/3/1/0/131070192/131070192.html#breathing+exercise+for+stammering

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000034b3.bin
c979778377d9cd6449253e3834d94198a9dceaf349e82896d4e773dc77991c43		 pdf-font-stream PDF embedded font (sfnt) at offset 0x34B3 7588 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.