Malicious PDF — malware analysis report

Static analysis result for SHA-256 5c93c00136e6e472…

MALICIOUS

PDF

33.0 KB Authoring application: QPDF
MD5: cd972c9981de85ba578064d170e24124 SHA-1: 3eac6b82293f71e00c6d4ba85d39f04146710275 SHA-256: 5c93c00136e6e47281298cd8163eebbe51bf3a5861d0c9eda58eb317ae3982ed
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The document body contains a large number of embedded URLs pointing to external PDF files across various domains, suggesting a link farm or a distribution mechanism for further malicious content. The presence of these links and the overall structure strongly suggest a phishing or SEO manipulation attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://resort24stay.online/uploads/1/3/0/3/130323250/vuwipuma.pdf
    • http://invrnc.net/uploads/1/3/0/3/130323268/sotezuzufalej_sewabo_gesamubudosotas.pdf
    • http://jtsecurite.com/uploads/1/3/0/7/130775536/3d93dd5bf679f.pdf
    • http://alliancebridgemanagement.com/uploads/1/3/0/5/130588724/podimezokomu.pdf
    • http://www.cscc20.com/uploads/1/3/0/2/130287973/barug.pdf
    • http://tangofilmsla.com/uploads/1/3/0/6/130620642/suwipomusot_gogapex_xefubamegumo.pdf
    • http://www.rickli-art-schweiz.com/uploads/1/3/0/3/130313670/2253021.pdf
    • http://mrhowe.org/uploads/1/3/0/3/130379299/nuzitewudax-bakolexubebolut-zomuvono-mopegagosin.pdf
    • http://sellhousefastpoway.com/uploads/1/3/0/2/130289354/gorizitej-lagegodizak-vedorijesoz.pdf
    • http://www.bottomlinediaperbank.org/uploads/1/3/0/5/130543945/4404146.pdf
    • http://projectindigo.co/uploads/1/3/0/4/130478520/sinajinebir_nadus_jojosu_piguruvatogaw.pdf
    • http://cherry-supply.com/uploads/1/3/0/8/130873829/5280116.pdf
    • http://suejardin.studio/uploads/1/3/0/6/130640235/2606450.pdf
    • http://chamuel.solutions/uploads/1/3/0/7/130739063/29186f5cbddd.pdf
    • http://protechion.us/uploads/1/3/0/5/130543050/walimuf.pdf
    • http://carmonscurlupanddye.com/uploads/1/3/0/6/130620997/dijemusekej_kuvapijeweloju_fimafogadif.pdf
    • http://mail.susansimons.com/uploads/1/3/0/5/130540072/tarobabixabejosiruv.pdf
    • http://cts4.com/uploads/1/3/0/6/130620390/6752980.pdf
    • http://adminsolutionsservices.com/uploads/1/3/0/9/130969129/kozatubuzekekid.pdf
    • http://bluewaternrhs.org/uploads/1/3/0/6/130604988/9378502.pdf
    • http://www.jimbojohngault.com/uploads/1/3/0/3/130313123/voxofikit.pdf
    • http://forkthecommons.com/uploads/1/3/0/7/130739878/rolesipar.pdf
    • http://speculos.ca/uploads/1/3/0/6/130620614/905b2971ddc6a6.pdf
    • http://fdqky3qu.brdge.org/uploads/1/3/0/6/130621732/130621732.html#exercices+corrig%C3%A9s+enregistrement+algorithme+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001d58.bin
beb3a5b9701c54b4dda8b23c9f7df71590c788f8f8e8dddceeba234b7eee99d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D58 8480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.