Malicious PDF — malware analysis report

Static analysis result for SHA-256 1515f7e0c9421860…

MALICIOUS

PDF

37.8 KB Authoring application: Soda PDF
MD5: 4cbfc50de2ddd6604bb726b242ed9e56 SHA-1: 0518636f5b9293616e81023fefd621cb23161719 SHA-256: 1515f7e0c9421860316d0ce861b0dbc226db3ec03efdd75465e0df0555c4a794
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file was detected as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing lure. It contains a large number of embedded URLs pointing to other PDF files, suggesting a link farm designed to distribute malware. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates that the document may be part of a multi-stage attack, potentially requiring a password to decrypt a payload.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://misfitcrusaders.com/uploads/1/3/0/4/130475992/2872858.pdf
    • http://fobuluzav.handorinservice.ru/uploads/2020/01/28/185536c22bf65b.pdf
    • http://kisen.pitprombu.ru/uploads/2020/01/28/jobaredovimajikega.pdf
    • http://repwavets.org/uploads/1/3/0/5/130551106/82003401.pdf
    • http://mysteryplus.nl/uploads/1/3/0/4/130476271/mawopup_tevidodi.pdf
    • http://pitu.lamebelmodern.ru/uploads/2020/01/28/44fa72529867960.pdf
    • http://mrmacbiblebook2.com/uploads/1/3/0/3/130313306/130313306.html#examen+de+sexto+grado+de+primaria+segundo+bimestre+con+respuestas

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001383.bin
e02dc3a0e28b607282c43162c0e75a5efd5bf91ea7375ada51aae8e8c9c00052		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1383 9256 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.