Malicious PDF — malware analysis report

Static analysis result for SHA-256 5534d99d241ae10a…

MALICIOUS

PDF

36.1 KB Authoring application: Serif PagePlus
MD5: 06cc13389dfd7d91f1fca96650fe2a29 SHA-1: f7bc49bc9ca14b5055e15b4b0b2701bd1880649a SHA-256: 5534d99d241ae10aba75bf2da881ba1f8100a2d793afb044730efa8db8a1d78f
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by multiple heuristics, including a critical PDF_SEO_LINK_FARM firing and ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0. The document contains a large number of embedded URLs pointing to external PDF files, suggesting a link farm designed to lure users to potentially malicious content. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://moses-michael.com/uploads/1/3/0/5/130539125/7656343.pdf
    • http://3lmboutique.com/uploads/1/3/0/5/130551461/bilakajizominilap.pdf
    • http://dirkhasslehoff.com/uploads/1/3/0/5/130588954/9707433.pdf
    • http://norwoodhighschool.net/uploads/1/3/0/5/130551581/2198991.pdf
    • http://tradeltgg.com/uploads/2020/01/28/836e72745.pdf
    • http://nowator.eu/uploads/1/3/0/3/130313307/fifun.pdf
    • http://nintaipartners.com/uploads/1/3/0/4/130435638/e5d50f76285.pdf
    • http://r-ewolucje.com/uploads/1/3/0/5/130588956/15eba1ad.pdf
    • http://debtreliefamerica.net/uploads/1/3/0/5/130543310/0411fb.pdf
    • http://sponsorforhire.com/uploads/1/3/0/4/130483670/87efc1d9c4.pdf
    • http://rejointz.com/uploads/1/3/0/6/130622012/botikibekotito-mozakupug.pdf
    • http://treper.se/uploads/1/3/0/4/130483795/dazudixifukiwixab.pdf
    • http://zambiasafarihunting.com/uploads/1/3/0/5/130551589/130551589.html#imagine+dragons+smoke+and+mirrors+live

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001330.bin
a1a8c66e95df8491d10e5e76781dcfbaf80f744d4e8535d363370026f65d3bef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1330 9292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.