Malicious PDF — malware analysis report

Static analysis result for SHA-256 55e399bb4a84b38c…

MALICIOUS

PDF

42.5 KB Authoring application: Smallpdf Desktop
MD5: ab801d4533426f4f6858a21aa5f3c53e SHA-1: 0a848a6ceb1b31d0fde1a28efae15302bfea91e8 SHA-256: 55e399bb4a84b38c2ae3d5b5544101e0a240ab2fab4401c5eb032ba024d432b3
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and a critical PDF_SEO_LINK_FARM alert. The document body contains a large number of embedded URLs, with the primary domain being 'betasproject.online'. These links are likely used to redirect users to phishing sites or download further malicious content, aligning with a phishing attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://betasproject.online/uploads/2020/01/28/5749507.pdf
    • http://keneni.speacetech.us/uploads/2020/01/27/b4d63a4.pdf
    • http://oratio.ca/uploads/1/3/0/6/130603688/f4e2acd.pdf
    • http://davidmazurphoto.com/uploads/2020/01/27/8bd5290.pdf
    • http://concentricoperationsgroup.com/uploads/1/3/0/6/130620955/vanoxi.pdf
    • http://pamavi.nttrus.com/uploads/2020/01/28/1837155.pdf
    • http://hectormaxwell3d.com/uploads/1/3/0/5/130588487/pigesukul.pdf
    • https://xulasijowe.weebly.com/uploads/1/3/0/5/130547038/vafij_mikorevenixizaz_xufolisosenus.pdf
    • http://azucarpanela.com/uploads/2020/01/29/sifupawevolekigudu.pdf
    • http://greyghosttac.com/uploads/1/3/0/6/130603783/2638d984b7848.pdf
    • http://jakibatoru.wpchoice.net/uploads/2020/01/28/wejobimewisane.pdf
    • http://nichellerenee.solutions/uploads/1/3/0/2/130270869/2618120.pdf
    • http://shadelandcommercepark.com/uploads/1/3/0/6/130604556/kegopifux_luxedemosu_potesabiditu.pdf
    • https://wozilobi.weebly.com/uploads/1/3/0/2/130272551/2bc9e8f82a6cd.pdf
    • http://butlerandwood.com/uploads/1/3/0/2/130287521/dareriwid_jufolosajoz_bifisegow_dixivu.pdf
    • http://volip.eosplit.ru/uploads/2020/01/28/lotazufefa.pdf
    • http://geravutuk.sunparkspb.com/uploads/2020/01/29/nalarero.pdf
    • http://zazize.botanicart.ru/uploads/2020/01/27/5881961.pdf
    • https://joxabazebuzika.weebly.com/uploads/1/3/0/5/130545365/kikata.pdf
    • http://managedbylvtn.com/uploads/1/3/0/5/130551991/1355367.pdf
    • http://jesseflynnlaw.com/uploads/1/3/0/2/130272290/sitiralepugefef-mubuguvob.pdf
    • https://wulumevidozida.weebly.com/uploads/1/3/0/4/130476594/dfd6b.pdf
    • http://blackburnmarketers.com/uploads/1/3/0/4/130436130/f06ab04d276.pdf
    • http://pob.gruzodelov.ru/uploads/2020/01/28/4addfec451.pdf
    • http://stmarysoccer.com/uploads/1/3/0/6/130620547/3614565.pdf
    • http://kevindalymusic.com/uploads/1/3/0/6/130604294/130604294.html#west+side+story+maria+piano+sheet+music
    • http://pob.gruzodelov.ru/uploads/2020/01/28/4addfec451.p

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001768.bin
98e8f13eaa9cbc51ef6435e9070f75743b9aaeb5d0f47730c57d3ac42e05876d
pdf-font-stream PDF embedded font (sfnt) at offset 0x1768 8404 bytes
font_01_sfnt_off000058f4.bin
062abeeb0630068c9ebda4cd69880ba7d22c023ef851e82e77d1a768bfa0705b
pdf-font-stream PDF embedded font (sfnt) at offset 0x58F4 17648 bytes