Malicious PDF — malware analysis report

Static analysis result for SHA-256 0f5eeb4dbdcfb81d…

MALICIOUS

PDF

40.8 KB Authoring application: Scribus
MD5: 05e94e889daf123846cd47f940434299 SHA-1: d86998be44e32d8cc8bf0b72693e832011a28f56 SHA-256: 0f5eeb4dbdcfb81d25b37c08222252d429e7f3796b998f896bf32ba5c16fd815
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file is identified as malicious by ClamAV and an ML classifier, and contains a large number of embedded links to other PDF files. The document body, though heavily obfuscated, contains keywords related to religious texts, suggesting a lure to disguise the malicious link farm. The primary attack pattern involves using a seemingly innocuous document to trick users into visiting a large number of external PDF links, likely leading to further malicious content or exploits.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7978374-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7978374-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bentleyconnection.com/uploads/1/3/0/2/130289236/c9b2c8c819bd7bc.pdf
    • http://dayakquest.com/uploads/1/3/0/5/130543276/xilok-nijupabofodiwu-zupaxazek-kajud.pdf
    • http://www.sonorandogboots.com/uploads/1/3/0/9/130969354/kexejes.pdf
    • http://wellwellcreative.com/uploads/1/3/0/5/130589101/c9b0385c7.pdf
    • http://www.claireannemcwilliams.co.uk/uploads/1/3/0/5/130550972/6644269.pdf
    • http://theorderoftheoak.org/uploads/1/3/0/4/130483863/7319665.pdf
    • http://beatexpansion.com/uploads/1/3/0/4/130483288/muzagow_gipiguvolibive_dijixajosira.pdf
    • http://555consulting.com/uploads/1/3/0/4/130490776/moromabada.pdf
    • http://onelife.coach/uploads/1/3/0/5/130551418/mujaw.pdf
    • http://nliaustralia.com/uploads/1/3/0/5/130590596/xozuwipep-xawusabemazapaj-bebugez.pdf
    • http://spectrum-capital.com/uploads/1/3/0/8/130874635/8bfdf.pdf
    • http://divi-expert.com/uploads/1/3/0/7/130776152/8267340.pdf
    • http://aceeoptical.com/uploads/1/3/0/3/130313453/favami.pdf
    • http://nissenwindows.com/uploads/1/3/0/5/130551794/jofafa-tapupuna-rubogibadobib-tuluxulosug.pdf
    • http://shop.sistersgrimmghosttour.com/uploads/1/3/0/7/130775892/5268481.pdf
    • http://selenebasketsantagata.com/uploads/1/3/0/6/130639916/8605561.pdf
    • http://www.speech-talks.com/uploads/1/3/0/6/130620818/sanasovu.pdf
    • http://christieaariaemby.com/uploads/1/3/0/6/130640024/vivavif_remaliputog_devuwi_lusikifa.pdf
    • http://www.dbseventy.com/uploads/1/3/0/5/130547969/jisanob-retojumon-mezuri.pdf
    • http://notemonkey.net/uploads/1/3/0/2/130288861/sojudagipapo.pdf
    • http://rebylez.store/uploads/1/3/0/2/130291593/wegutapobewum.pdf
    • http://iothinx.com/uploads/1/3/0/6/130620267/5974829.pdf
    • http://orcajewelry.com/uploads/1/3/0/3/130323518/c4741d42a6058.pdf
    • http://nishati-healer.org/uploads/1/3/0/3/130324248/sumexoxofope.pdf
    • http://www.paliisraeliconflict.com/uploads/1/3/0/4/130435892/3199988.pdf
    • http://indoorqualityaircody.com/uploads/1/3/0/6/130620532/130620532.html#yajurveda+amavasya+tharpanam+sanskrit+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003a09.bin
0525e996d24c9ef039013d4afeb8fff4e57024bb5cf4f5e13f4efd15d8814481		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A09 8320 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.