Malicious PDF — malware analysis report

Static analysis result for SHA-256 5afd82c67051e476…

MALICIOUS

PDF

41.5 KB Authoring application: PDF Studio
MD5: 1ce3d68ead29981f74fdc4270d988d46 SHA-1: 28ed71625177a112ed73f0c97afb001572cd6ff2 SHA-256: 5afd82c67051e4764fdf7f76b6f98a6e5d8ac83521a3c28151127c601a6d1f5f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, masquerading as an aptitude test. This behavior is indicative of a link farm or phishing lure designed to redirect users to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.thereforemade.com/uploads/1/3/0/3/130312919/majajivuxenupaj-wimuv-nijavilitib.pdf
    • http://rockout.live/uploads/1/3/0/7/130740224/birawalo.pdf
    • http://nemogator.com/uploads/1/3/0/6/130604589/678751e5671f8.pdf
    • http://heritage-homestead.com/uploads/1/3/0/6/130639916/531836.pdf
    • http://clever-marketing-concepts.com/uploads/1/3/0/7/130738812/sugegafawatepuveluji.pdf
    • http://alopecian.com/uploads/1/3/0/2/130288644/lupokituxizopuboni.pdf
    • http://gemstonecommuniteis.com/uploads/1/3/0/2/130288864/2756553.pdf
    • http://www.adey-8.com/uploads/1/3/0/8/130813736/kituporawapopumo.pdf
    • http://psychologyforschools.com/uploads/1/3/0/6/130620620/vobomugakeriligudev.pdf
    • http://mail.montenegromotel.com/uploads/1/3/0/2/130274378/ludapigatiboj_bumoteranofad_rorarasumisam_sojitinorem.pdf
    • http://grownraisedmade.com/uploads/1/3/0/6/130603850/9066128.pdf
    • http://28daycharitychallenge.com/uploads/1/3/0/2/130289681/sapivuzo.pdf
    • http://drlupita.com/uploads/1/3/0/3/130323421/ledamelezabube-rufivedil-lujawojuvos.pdf
    • http://penelopeknuth.com/uploads/1/3/0/2/130273893/9364278.pdf
    • http://voicesbydcon.com/uploads/1/3/0/3/130323251/a672cc.pdf
    • http://southeastjet.com/uploads/1/3/0/4/130435766/mubuveku.pdf
    • http://hotelvic-phase2-zt.devsite-1.com/uploads/1/3/0/6/130604527/6efa6a79d.pdf
    • http://painfulhip.org/uploads/1/3/0/6/130639269/torotutajuser.pdf
    • http://built4love.com/uploads/1/3/0/5/130539818/nusaravepodugex-kesajidudox.pdf
    • http://knitwhats.com/uploads/1/3/0/8/130874039/473561.pdf
    • http://getfantasticweed.com/uploads/1/3/0/5/130538986/42c6704.pdf
    • http://sigroymusic.com/uploads/1/3/0/2/130270776/544720d.pdf
    • http://moms-space.net/uploads/1/3/0/3/130323329/1823064ee852.pdf
    • http://emobamuseum.org/uploads/1/3/0/6/130620573/pulojivixapigutos.pdf
    • http://0fyq5.bpmtc.com/uploads/1/3/0/5/130550770/130550770.html#ey+numerical+reasoning+test+2019

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003fcd.bin
03021e14336da6a5354ccda0cc295bb33a64800058ee887bca5a3d35a608e9d8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3FCD 7588 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.