Malicious PDF — malware analysis report

Static analysis result for SHA-256 4d5c43898e448fdb…

MALICIOUS

PDF

37.9 KB Authoring application: pdf-parser
MD5: 0605dcc7ed78633a9c1fca71f34cc3c8 SHA-1: 63d984d05625c126ee81a2915997a8dd7b8dc59a SHA-256: 4d5c43898e448fdb4e5f33504a654ececb2809e54d2515e61ade14758ff0b82b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate maliciousness, consistent with a phishing or content distribution scheme. No scripts were extracted, but the primary attack pattern involves directing users to external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nugriot.com/uploads/1/3/0/2/130271043/jeluzawit.pdf
    • http://alabama911group.com/uploads/1/3/0/6/130621455/fijovudadaludor.pdf
    • http://mquest.space/uploads/1/3/0/3/130313398/430fa2224e5ef21.pdf
    • http://queensontherun.com/uploads/1/3/0/3/130379596/1544982.pdf
    • https://morarafaf.weebly.com/uploads/1/3/0/5/130590224/ruxoxegojaw_temurelatowa.pdf
    • http://northernnerd.com/uploads/1/3/0/6/130620679/mopuzipowidimiledoj.pdf
    • http://monaco-trade.com/uploads/1/3/0/4/130476262/2715227.pdf
    • http://sanjosedelosreynoso.com/uploads/1/3/0/3/130323479/woropolimo_vitikifo_lifakesevozi_pizasemizaguse.pdf
    • http://abdullah-francis.com/uploads/1/3/0/4/130435766/mopabedezipafa_jumolejola_biwiza_tuxababokegeti.pdf
    • http://prolinelifepharmaceutical.com/uploads/1/3/0/4/130483052/130483052.html#broadway+used+auto+parts

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000129d.bin
545ca85d764c208cca4f80737ec8d06c2bef685679a0ff7e8cbfb0e6eafe8771		 pdf-font-stream PDF embedded font (sfnt) at offset 0x129D 8728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.