Malicious PDF — malware analysis report

Static analysis result for SHA-256 36fce5e6f39ef975…

MALICIOUS

PDF

47.1 KB Authoring application: PDF Studio
MD5: 15b361a232c796a86883bd0157cf6b7c SHA-1: 27b4278bf570f0e0fb73d055f41699eaccac68fe SHA-256: 36fce5e6f39ef97577cca8cf28e0f843aa8b3eb5b44b16422eca0f2f95ea71de
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by multiple heuristics, including a critical finding for a link farm and ClamAV detection as phishing malware. The embedded document body contains numerous URLs, suggesting a phishing or malicious redirection attempt. The primary attack pattern involves leveraging a large number of external links within the PDF.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ligi.sunilchoudhary.site/uploads/2020/01/29/9036100.pdf
    • http://hamcox-ray.com/uploads/1/3/0/6/130621464/fanubujob.pdf
    • http://caqrecords.com/uploads/1/3/0/5/130539260/popaxolomuxitibivibi.pdf
    • http://experiencetsuruoka.com/uploads/1/3/0/6/130603894/8117863.pdf
    • http://alphachiomegaofoaklandcounty.org/uploads/1/3/0/2/130270869/jurovufiso.pdf
    • http://oiaracing.com/uploads/1/3/0/2/130272580/488d261812b17f.pdf
    • http://mrspaynes.com.au/uploads/1/3/0/4/130476423/lelewador-veloj-doforo.pdf
    • http://alliesonthejourney.com/uploads/1/3/0/2/130289597/5508073.pdf
    • http://staceylytle.com/uploads/1/3/0/6/130605143/sovefugi.pdf
    • http://techsuny.com/uploads/1/3/0/2/130272442/8617388.pdf
    • http://mmarieboutique.com/uploads/1/3/0/6/130605017/fivixirurajiperaxu.pdf
    • http://steamsa.org/uploads/1/3/0/6/130639504/8217462.pdf
    • http://rebeccalaplacaattia.com/uploads/1/3/0/2/130288643/130288643.html#partituras+bossa+nova+guitarra+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000137f.bin
0f730c1be151274c579b5b5e94552a5e6984c2879951b7bc5856891a917f3097		 pdf-font-stream PDF embedded font (sfnt) at offset 0x137F 10068 bytes
font_01_sfnt_off0000706b.bin
7ff88f53d66e1e1af09095ae2aafd24724a6d24c5122ccfc2e32e96e1b1cf35b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x706B 16492 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.