Malicious PDF — malware analysis report

Static analysis result for SHA-256 5b5951984cbbd8bc…

MALICIOUS

PDF

35.0 KB Authoring application: ImageMagick
MD5: deb40e3d9f54d55a82abd80a3f833279 SHA-1: 95c98486790fdead97cf0eb02554b6f69b705c6e SHA-256: 5b5951984cbbd8bc0cd28128b591127c2b01813cff204b62301ca80dac648053
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded URLs pointing to other PDF files across numerous domains, a technique often used for SEO spam or to distribute malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, consistent with a phishing or content distribution scheme. No scripts were extracted, but the embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thecraft2draft.com/uploads/1/3/0/5/130590637/5118553.pdf
    • http://northstarbees.com/uploads/1/3/0/5/130590438/335934.pdf
    • http://12250parkway.com/uploads/1/3/0/6/130640220/wariju.pdf
    • http://netspeedsolutions.com/uploads/1/3/0/5/130539107/990048.pdf
    • http://caeciliesvensson.com/uploads/1/3/0/5/130551362/buzuxatifipipajokewu.pdf
    • http://barryboycephotos.com/uploads/1/3/0/2/130289724/7343458.pdf
    • http://wickedricks.com/uploads/1/3/0/3/130323510/3b078.pdf
    • http://bluffcitycreative.com/uploads/1/3/0/4/130483243/5b46e05f4dd.pdf
    • http://wabashtees.com/uploads/1/3/0/6/130620305/5685875.pdf
    • http://xpr-motorcycle-tuning.weebly.com/uploads/1/3/0/6/130621406/92f4d92ba3ab.pdf
    • http://intentionalfitness.club/uploads/1/3/0/4/130476157/mofakuw.pdf
    • http://rehphotography.org/uploads/1/3/0/6/130640232/130640232.html#a1+a2+english+test+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012a2.bin
92ddb85881d102266293a007a647ca06a4e92785eb462cdb4533e259aa852a12		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12A2 8864 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.