Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a2c1908395fc054…

MALICIOUS

PDF

38.9 KB Authoring application: Serif PagePlus
MD5: a52baaeddc5c2e02ed78a57a1d7d7486 SHA-1: 27f9dc53b8f18d35fd1f43214464205b94bd3e80 SHA-256: 1a2c1908395fc054d002f63b4827d0758956196581f1b6b99b736d418cdd64a4
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass external link farm, directing users to multiple PDF and HTML files hosted on various domains. The document body mentions 'Eeo- 1 component 2 reporting', suggesting a lure to trick users into clicking the malicious links. The ClamAV detection and ML classifier further support its malicious nature, classifying it as phishing and a potential installer.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://oboeandbassooncamp.com/uploads/1/3/0/4/130435710/sozufutaf_dabujajewoz.pdf
    • http://thefundamentallife.com/uploads/1/3/0/6/130604590/9858810.pdf
    • http://dojivikef.bibaandboba.info/uploads/2020/01/29/1a04de967.pdf
    • http://edgelandscapeandmaintenance.com/uploads/1/3/0/6/130639698/130639698.html#eeo-+1+component+2+reporting

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000ffe.bin
459364912bc72b11380d7103554b2a5b720b583bc0a8a54738dabd93b591b9ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFFE 8776 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.