Malicious PDF — malware analysis report

Static analysis result for SHA-256 4359126354c63941…

MALICIOUS

PDF

41.4 KB Authoring application: Serif PagePlus
MD5: 0a75cf4eec5a0ae88a7cff1c8c1ecbcd SHA-1: 71e0855381c463d904fddc020210fedb9da31102 SHA-256: 4359126354c63941a147ce5656c89eb76cdb2c96e0c48e5e2516dd35d70121ce
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The PDF_SEO_LINK_FARM heuristic identified a large number of embedded external links, with the primary URL being http://ivoryleaguepublishing.com/uploads/1/3/0/5/130589230/tozepexe-kefubetisos-zopememuz.pdf. This suggests the document's purpose is to redirect users to a network of potentially malicious sites, likely for SEO manipulation or to serve further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ivoryleaguepublishing.com/uploads/1/3/0/5/130589230/tozepexe-kefubetisos-zopememuz.pdf
    • https://woliwegaxuro.weebly.com/uploads/1/3/0/3/130313564/937581.pdf
    • http://bomovuw.alkovozim.com/uploads/2020/01/27/897138.pdf
    • http://waj.144lonn.xyz/uploads/2020/01/28/fotavegowasine.pdf
    • http://mercywilder.com/uploads/1/3/0/6/130620384/6721404.pdf
    • http://ved.fxtradeltd.info/uploads/2020/01/28/niperiduto.pdf
    • http://curatedchoice.co/uploads/1/3/0/6/130604241/598262.pdf
    • http://loilyyoursessentials.com/uploads/1/3/0/3/130313370/d8b5bd.pdf
    • https://jibakuzudulevu.weebly.com/uploads/1/3/0/6/130604078/6522843.pdf
    • http://trojantheatre.weebly.com/uploads/1/3/0/4/130483354/870975.pdf
    • http://mikescottthomson.com/uploads/1/3/0/6/130621206/guginejatilam_dujokabusedobut_tipixixepot_vipitilewiw.pdf
    • http://devatacircle.org/uploads/1/3/0/6/130639235/kanogamozerake.pdf
    • http://taxauctiontitle.com/uploads/1/3/0/4/130489082/tuzilarutemiti.pdf
    • http://worldheartsfairtrade.org/uploads/1/3/0/5/130590297/lurigubetikutijopog.pdf
    • https://jedezejavotijox.weebly.com/uploads/1/3/0/2/130289284/6283348.pdf
    • http://fotemu.royalemates.com/uploads/2020/01/28/6765961.pdf
    • https://pixufasaru.weebly.com/uploads/1/3/0/6/130603975/1406412.pdf
    • http://mmjplantation.org/uploads/1/3/0/3/130323892/xabixogelije-jepiwixedunu-sabetoso-senifageb.pdf
    • http://coolseminarytutorials.com/uploads/1/3/0/6/130604108/viboses-lujimofijem-goziwuwusavoliv.pdf
    • http://xalimadsgn.com/uploads/1/3/0/3/130323175/3201932.pdf
    • http://sheriffproperties.com/uploads/1/3/0/6/130639762/0586e2aa7d44.pdf
    • http://subofoze.piterlife-78.ru/uploads/2020/01/28/1eac0e2.pdf
    • http://coachrenee2u.com/uploads/1/3/0/5/130546645/130546645.html#siswati+bible+apk+free

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001717.bin
0097b6648771119bb948dd7180a9568e4b4a4bcdb69887befcd552a38a77075e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1717 8864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.