Malicious PDF — malware analysis report

Static analysis result for SHA-256 1036a976a2affb52…

MALICIOUS

PDF

37.4 KB Authoring application: PDFedit
MD5: bce0664bfd6f849cb773076034166812 SHA-1: 9240db2517fc562ae56dda479bce67f3857e8586 SHA-256: 1036a976a2affb529b5994e924a7994338149d01599324e7ec0bd7da9c6720d0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a mass external link farm, with most URLs pointing to other PDF files, suggesting a phishing or malware distribution scheme. The document body presents a fake application form for government registration to entice users to click on these links. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or credential harvesting.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://psyfit.net/uploads/1/3/0/4/130476427/3221220.pdf
    • http://ssteeleenterprises.com/uploads/1/3/0/3/130324315/vitok.pdf
    • http://belleamieridingacademy.com/uploads/1/3/0/6/130640048/wozogupix.pdf
    • http://mtdistrictlwml.com/uploads/1/3/0/5/130539885/xerogux_nadezewola_pakuvanufunodo.pdf
    • http://psychotherapeute-paris.net/uploads/1/3/0/6/130621521/7a963b.pdf
    • http://ashleymossphotography.weebly.com/uploads/1/3/0/2/130289732/jedusow-vixawuzafud-gasorin-dedatidapepew.pdf
    • http://sorcerersatchel.com/uploads/1/3/0/3/130313105/bojejojele.pdf
    • http://veranda-tort.ru/uploads/2020/01/28/1877113.pdf
    • http://mysoundcollective.com/uploads/1/3/0/7/130775195/130775195.html#udyog+aadhaar+application+form+online
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011d5.bin
a520358f578bf5a4eb13a98f02a49dbe739875e5aef89c232ce2318a48488b7f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D5 8128 bytes
font_01_sfnt_off00004dac.bin
68dbc7a19cb7fc5756a0b8a22b9cda79aae43024c200d582c71509e1ae735566		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4DAC 7168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.