Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a48bd709ed2956a…

MALICIOUS

PDF

36.3 KB Authoring application: Serif PagePlus
MD5: 4561250ca7f30d4f0bbee80a4e291ebd SHA-1: 48f71241ad30582ff353206b9066e4bddc93d4f5 SHA-256: 5a48bd709ed2956a8d8018c580d728b3c35eb8ec1c38140e9f37a8b23bbf83a8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was identified as malicious by ClamAV and a machine learning classifier, exhibiting characteristics of a phishing or SEO spam campaign. The document contains a large number of embedded URLs pointing to other PDF files, likely intended to manipulate search engine rankings or serve as a distribution point for further malicious content. No scripts were extracted, but the presence of numerous external links suggests a content-delivery or redirection mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mlbcruises.com/uploads/1/3/0/6/130639027/01bc2.pdf
    • http://midwest-grow.com/uploads/1/3/0/4/130436252/rebetojirevuxirum.pdf
    • http://nastybritches.com/uploads/1/3/0/6/130620897/1115268.pdf
    • http://newenglandgoodlife.net/uploads/1/3/0/3/130379824/ferotesutikidi.pdf
    • http://bantambloom.com/uploads/1/3/0/7/130738861/wexapetovaj.pdf
    • http://learninglifestyleproject.net/uploads/1/3/0/7/130739500/5107137.pdf
    • http://bayareapsychotherapyassociates.com/uploads/1/3/0/4/130475980/fcee16e12aebe1.pdf
    • http://theusacommerce.com/uploads/1/3/0/2/130272438/rikeputuvo-kilamafan.pdf
    • http://nicetonehk.com/uploads/1/3/0/6/130639661/4349775.pdf
    • http://excelbusinessintelligence.com/uploads/1/3/0/4/130491850/zakuralofupitel_zuxowulu_sijavefexotej_jikidonoluto.pdf
    • http://beautecocktail.com/uploads/1/3/0/8/130813931/jijeloligilade.pdf
    • http://conjecturebooks.org/uploads/1/3/0/7/130738511/98274087efa847.pdf
    • http://gypsyjunkmichigan.com/uploads/1/3/0/6/130621100/8557871.pdf
    • http://achomecleaningservices.com/uploads/1/3/0/5/130545421/5d501a61a82c9e.pdf
    • http://www.cmagruder2009.com/uploads/1/3/0/8/130873990/demibufu_xogetalotof_noputonimibo.pdf
    • http://johnsteinman.net/uploads/1/3/0/5/130544494/b16ee28a5af.pdf
    • http://jvlawnsservices.com/uploads/1/3/0/4/130488498/7018102.pdf
    • http://nicolealisonart.com/uploads/1/3/0/7/130738975/9572824.pdf
    • http://richmondvideoservices.com/uploads/1/3/0/6/130639679/9471384.pdf
    • http://mrgospelmusic.com/uploads/1/3/0/7/130740192/liganuxekexo_fakugixadiko_vatude_kedobiwava.pdf
    • http://www.rrbeautyenthusiast.com/uploads/1/3/0/3/130312953/2839162.pdf
    • http://www.cscc20.com/uploads/1/3/0/2/130287973/barug.pdf
    • http://medecines-bizarres.net/uploads/1/3/0/2/130272092/e7cb5076447ea1.pdf
    • http://austinbelow.com/uploads/1/3/0/8/130874478/9090515.pdf
    • http://adsl-63-204-18-29.benefitplans.org/uploads/1/3/0/5/130551925/130551925.html#action+and+linking+verb+activities

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ad3.bin
ac014babd05159d52956b9379be42d53a88c63f17847b087f4ac070b72d21bee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2AD3 7644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.