Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b3e84d50f3daf4e…

MALICIOUS

PDF

37.8 KB Authoring application: Adobe PDF Library 9.0
MD5: fcc8388a9cb0760f9b1cac88ca454f0c SHA-1: 52a1e6462be953d42a3c8f0d53dbfe820c8a6f33 SHA-256: 5b3e84d50f3daf4e3f0920325d09a1919e44ef867c07b597f53f79cb7b8d1aa9
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links pointing to external PDF files, a technique often used for SEO spam or to redirect users to malicious content. ClamAV and ML classifiers also flagged this file as malicious, specifically identifying it as a phishing attempt. The embedded URLs are the primary indicators of compromise, suggesting a redirection or phishing campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vacavilleselfstorage.org/uploads/1/3/0/3/130379479/tutofafe.pdf
    • http://speakeasyliverpool.co.uk/uploads/1/3/0/6/130603809/0e17aaed02f7.pdf
    • http://bibledaily.com/uploads/1/3/0/6/130639036/7711128.pdf
    • http://cristinasbridalma.com/uploads/1/3/0/5/130551214/ramez.pdf
    • http://nkbadvisors.com/uploads/1/3/0/3/130323092/79262.pdf
    • http://msgland.com/uploads/1/3/0/7/130776451/gowotelewegal.pdf
    • http://swiftcustommetal.com/uploads/1/3/0/3/130312968/336425.pdf
    • http://birivamal.unikmetal.ru/uploads/2020/01/29/1126b728bfd1711.pdf
    • http://somersetfoodtrail.org/uploads/1/3/0/6/130604544/130604544.html#test+for+rotator+cuff+impingement

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001120.bin
729a387931f3c7f127de98379ea9dfafd532ca5387699c62e2134873f834a863		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1120 7620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.