Malicious PDF — malware analysis report

Static analysis result for SHA-256 57959b84a796c02d…

MALICIOUS

PDF

36.0 KB Authoring application: GIMP
MD5: b93cacfbd1ef0760251046d1e9cfb5d8 SHA-1: 186bd7a40de64acdae69cfa45c9f7eec15b69521 SHA-256: 57959b84a796c02d86547759f3ef691984400881cefa5ba9685bfab25515da5d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to other PDF files, a technique often used for SEO poisoning or to distribute malicious content. The document body, though partially corrupted, suggests a lure related to college admissions. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution through the linked PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://midiklorians.com/uploads/1/3/0/2/130289424/8bfba529f68.pdf
    • http://nimbus-realty.com/uploads/1/3/0/5/130550879/guwiwuma_jawawu_nitiririzupet.pdf
    • http://cafed.tech/uploads/2020/01/29/9372710.pdf
    • http://pazur.kupitzerkalo.ru/uploads/2020/01/29/eb9f19a1.pdf
    • http://djharperoldschool.com/uploads/1/3/0/3/130312925/buzopab.pdf
    • http://musicalmonday.org/uploads/1/3/0/6/130621072/6728056.pdf
    • http://mrmacbiblebook2.com/uploads/1/3/0/6/130639259/130639259.html#college+admission+form+2019+haryana

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010d1.bin
0aa195c9b29c292992385f9b27429f989d8282b980f9b90d3cd3086c87ba6bbb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D1 8276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.