Malicious PDF — malware analysis report

Static analysis result for SHA-256 5784fe02414feaec…

MALICIOUS

PDF

40.1 KB Authoring application: Poppler-utils
MD5: 9ade39a7d7b3000288d0b68abb6af690 SHA-1: 54619302474213d5dff0f0410336010ea924ea18 SHA-256: 5784fe02414feaec1efd7fdad4c97331edfc899e4a7469e8324915626df7fbc4
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also indicate maliciousness, specifically classifying it as phishing-related. The embedded URLs likely serve to redirect users to malicious sites or to distribute further malware, aligning with a phishing or SEO-based distribution attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://heatherzidle.com/uploads/1/3/0/4/130436261/taporigo.pdf
    • http://www.ozewiezewoze.be/uploads/1/3/0/6/130639725/lojenejadu-nibat-giwovufis.pdf
    • http://kimprintzcustoms.com/uploads/1/3/0/7/130775525/raranoka.pdf
    • http://www.nomorepayments.org/uploads/1/3/0/6/130621349/lozujejigawabov.pdf
    • http://hostmaster.zenasanayoga.com/uploads/1/3/0/5/130541351/1747384.pdf
    • http://cxleadership.com/uploads/1/3/0/5/130588692/bofedigobodexuw-xinet-vujuvutijur-wiraxezo.pdf
    • http://marklawfirms.com/uploads/1/3/0/7/130738720/gimumo.pdf
    • http://www.videoinventoryprofessionals.com/uploads/1/3/0/3/130323232/b787eee761951.pdf
    • http://walkiesnairn.co.uk/uploads/1/3/0/6/130620520/nilikeroloxavu_rugosu_ronipulizolofe_zobixigavufowi.pdf
    • http://www.onetesting.org/uploads/1/3/0/9/130969989/5150040.pdf
    • http://platedalchemy.net/uploads/1/3/0/6/130639141/ruwuvizem.pdf
    • http://ingestibleoxygenassociates.com/uploads/1/3/0/6/130621089/7746975.pdf
    • http://jacobcarrolldesigns.com/uploads/1/3/0/7/130776503/9b30ed70c7.pdf
    • http://www.olypiandiner.com/uploads/1/3/0/7/130775171/8019790.pdf
    • http://onetopshot.site/uploads/1/3/0/5/130542972/kixiraximatatebef.pdf
    • http://amatowoodcrafts.com/uploads/1/3/0/7/130740202/32c8ca.pdf
    • http://www.sasheenmuacosmetics.com/uploads/1/3/0/8/130813518/1700f92f43.pdf
    • http://btmamusic.com/uploads/1/3/0/6/130620868/1625629.pdf
    • http://cpanel.albufeirainn.com/uploads/1/3/0/5/130588403/jedasadibore.pdf
    • http://mobadanceacademyus.com/uploads/1/3/0/2/130272071/garodekalud_foselavewebireb.pdf
    • http://www.noblestcapital.com/uploads/1/3/0/7/130775905/42726f81a576ea.pdf
    • http://www.halleeinc.com/uploads/1/3/0/2/130272339/2bd624a776.pdf
    • http://alwaysfuntravel.voyagerwebsites.com/uploads/1/3/0/4/130489020/130489020.html#laissez-faire+leadership+style+pdf
    • http://walkiesnairn.co.uk/uploads/1/3/0/6
    • http://pinhoe.devon.sch.uk/uploads/1/3/0/7/130739917/zemivaxutijaz.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003d6e.bin
d3fde10f9ec3a739c328ceeef9908b18df0551ef18306a1bf36d1244cd270271		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3D6E 6756 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.