PDF malware analysis — malicious · 5ccdc55166c509a5

MALICIOUS

PDF

29.2 KB Authoring application: PDFBox

MD5: ae18c3931bc7ec6c5653806534aa4570 SHA-1: c0992273371c8b935381c97d518a4b32af998480 SHA-256: 5ccdc55166c509a5e3c4e8fd533aec705a63b3eca4ef30f78b3cc43da39fefd3

172 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment

This PDF document is identified as a phishing lure, likely intended to direct users to a malicious website. The heuristic 'PDF_SEO_LINK_FARM' indicates the presence of numerous external links, with the first identified as http://oxfordnaa.com/uploads/1/3/0/5/130541208/juriwil_zizexobeb_zuwoliwume.pdf. The ML classifier and ClamAV detection strongly support its malicious nature. Although no scripts were explicitly extracted, the structure suggests an attempt to leverage embedded URLs for redirection.

Machine Learning

Nyx PDF Classifier malicious score 1.0000

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE

PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 29 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://oxfordnaa.com/uploads/1/3/0/5/130541208/juriwil_zizexobeb_zuwoliwume.pdf
- http://midwesternchristianacademy.org/uploads/1/3/0/5/130544001/tatisalago.pdf
- http://doctorberrytherapy.com/uploads/1/3/0/4/130483629/936193a884aa18c.pdf
- http://creativefreelancerdirectory.com/uploads/1/3/0/5/130552106/c2ce2410c.pdf
- http://dalestravel.info/uploads/1/3/0/6/130604248/2323394.pdf
- http://nowmetoo.com/uploads/1/3/0/5/130551011/fupigipinipafejukab.pdf
- http://alchemystejuice.com/uploads/1/3/0/7/130776026/busuzimevuwo.pdf
- http://messianicmetis.ca/uploads/1/3/0/3/130313333/2505e77cc65f306.pdf
- http://newmodelsofgeneralpractice.com/uploads/1/3/0/9/130969499/kariroxedunutirugul.pdf
- http://xhfkdhfkex.com/uploads/1/3/0/6/130604654/7d5ea159071.pdf
- http://mrvangeelsclass.com/uploads/1/3/0/8/130814351/toxumuga_votofiku_lavinixarevo_dunerejiwajo.pdf
- http://orumalayalamdiary.com/uploads/1/3/0/7/130774981/5db596be2da.pdf
- http://gypsygirlsportfishing.com/uploads/1/3/0/7/130775244/a64e4605992.pdf
- http://dragonclasp.com/uploads/1/3/0/2/130272394/5982007.pdf
- http://bandstore.net/uploads/1/3/0/6/130621473/571335.pdf
- http://familyfoltz.com/uploads/1/3/0/7/130739446/josekidexexijogo.pdf
- http://graffnaturopathyandmassage.com/uploads/1/3/0/2/130289496/60ab4c076eeebf9.pdf
- http://monolithcomputing.com/uploads/1/3/0/2/130273581/luxijivi.pdf
- http://www.fortworthchiomega.com/uploads/1/3/0/6/130604775/saputovuj.pdf
- http://novembereleven.net/uploads/1/3/0/7/130775011/1a6b4b56.pdf
- http://countylinelogisticscenter.com/uploads/1/3/0/5/130588843/1285079.pdf
- http://capellandegetsemani2018.devsite-1.com/uploads/1/3/0/6/130620280/130620280.html#agilent+multimeter+u1241b

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000017c2.bin` `d2873cfdcfb220e133c15550e331a06047650684177866eba73351cdca0cccf5`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x17C2	5456 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.