Malicious PDF — malware analysis report

Static analysis result for SHA-256 5d519617cb0fbca4…

MALICIOUS

PDF

37.6 KB Authoring application: QPDF
MD5: 21b3a057ec42e0d7101405741df7a175 SHA-1: cdc3eea42f63edf42de8f6450b5a19ca5892796d SHA-256: 5d519617cb0fbca47316f2fad5bf72f1be5a055f02b8074cbeb0f7c8984b3783
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of embedded URLs pointing to external PDF files, suggesting a link farm or a distribution mechanism for further malicious content. The document body's content is garbled and appears to be an attempt to disguise the malicious nature of the file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://premaconsulting.com/uploads/1/3/0/6/130603959/jezisevilodaduji.pdf
    • http://amanda-mccall.com/uploads/1/3/0/5/130551488/fixigafux.pdf
    • http://hhinternational.net/uploads/1/3/0/5/130550736/3956135.pdf
    • http://mta-sts.mail.squareroundpublishing.com/uploads/1/3/0/5/130539449/vezawidob-sufufeke.pdf
    • http://911bailbondsla.com/uploads/1/3/0/7/130775980/pabafudepixuga.pdf
    • http://bauerhomemakerservices.com/uploads/1/3/0/6/130604896/xuruxu.pdf
    • http://kccannabissymposium.com/uploads/1/3/0/3/130313595/kebiwaligowefus.pdf
    • http://millennialwellnesscenter.com/uploads/1/3/0/5/130539442/repurakopewibix-papusedikurup-tulasanunidu-dikid.pdf
    • http://feedburp.com/uploads/1/3/0/8/130814088/926539.pdf
    • http://blockchainicogroup.com/uploads/1/3/0/4/130476014/2733254.pdf
    • http://webpipes.net/uploads/1/3/0/6/130620626/pofubaf.pdf
    • http://millennialjapan.com/uploads/1/3/0/4/130476034/ratesexalonodaru.pdf
    • http://yourhealingenergy.com/uploads/1/3/0/3/130313082/433d85b0bb5a.pdf
    • http://www.mackenzieklahr.com/uploads/1/3/0/4/130477363/632341.pdf
    • http://royalavenuemusic.com/uploads/1/3/0/4/130476085/9130971.pdf
    • http://hillcountrypulse.com/uploads/1/3/0/6/130639506/pozabipox.pdf
    • http://shoebrewnation.com/uploads/1/3/0/4/130435546/2502828.pdf
    • http://beyoutifilychicbags.com/uploads/1/3/0/4/130483351/d456bd3fdad2b03.pdf
    • http://betawilloughby.com/uploads/1/3/0/4/130488332/kizavi.pdf
    • http://npsmonkey.net/uploads/1/3/0/4/130483389/lipuzuniladulub.pdf
    • http://nextanityradio.com/uploads/1/3/0/6/130639863/2c4e4.pdf
    • http://hasbara.ca/uploads/1/3/0/3/130323381/7802822.pdf
    • http://x0172818xstreamtravel.xsideas.com/uploads/1/3/0/5/130547999/130547999.html#comment+inserer+un+document+pdf+sur+word

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fe0.bin
1e3e3e7ac793b673010792be45ea1bbfcdb3e6f6af850c6f44e369d0e1c6cade		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FE0 9172 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.