Malicious PDF — malware analysis report

Static analysis result for SHA-256 5edfa33c983c9306…

MALICIOUS

PDF

41.9 KB Authoring application: PDFedit
MD5: 961310132ebc6aaadaebfc1698a76727 SHA-1: f9caeb51113bcbb2e2deae4b35ed0a9e69a31ea5 SHA-256: 5edfa33c983c93061bf458f6c45b7d66442f72b3867a65e3cb059a9a786f5371
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ClamAV and an ML classifier, exhibiting a critical heuristic for a large external PDF link farm. The document body contains numerous URLs pointing to PDF files hosted on various domains, suggesting a phishing or content distribution scheme. No scripts were extracted, but the sheer volume of external links indicates a coordinated effort to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bealegacybuilder.com/uploads/1/3/0/6/130621516/d5bc7a804844a.pdf
    • http://gregorylreece.weebly.com/uploads/1/3/0/6/130605073/9718504.pdf
    • http://wtcblackbox.com/uploads/1/3/0/4/130476390/dilisejiteji.pdf
    • http://salvis-pupusas.com/uploads/1/3/0/6/130620878/4574752.pdf
    • http://palmoil-expo.com/uploads/1/3/0/5/130543665/1dafae592c8.pdf
    • http://nativeroots-design.com/uploads/1/3/0/5/130544318/penigelusamo.pdf
    • http://fikela.trustevroservis.ru/uploads/2020/01/29/c6a8b35fa98667c.pdf
    • http://pijitoxo.expertmagnit.ru/uploads/2020/01/27/talopebiloxexi-pupipevum-tufuta.pdf
    • http://fomabexu.sargar.ru/uploads/2020/01/27/1075889.pdf
    • http://msbr.ca/uploads/1/3/0/4/130483923/8479471.pdf
    • http://summitdoulacare.com/uploads/1/3/0/5/130589339/jokikabemepofa.pdf
    • http://soso.vholste.ru/uploads/2020/01/28/8827194.pdf
    • https://gomemevatenefu.weebly.com/uploads/1/3/0/4/130483830/6647686.pdf
    • http://willowwolffurnishings.com/uploads/1/3/0/5/130589998/f4b59.pdf
    • http://tishgammill.com/uploads/1/3/0/5/130551859/1559205.pdf
    • http://lililalune.com/uploads/1/3/0/4/130436389/5067666.pdf
    • http://rebeccalaplacaattia.com/uploads/1/3/0/4/130476483/130476483.html#partners+in+performance+toronto

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013e4.bin
f1fb6c58587ef93aee117e52a3c81e537d757fc1a2915a797eeb9a76853cba67		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13E4 8164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.