Malicious PDF — malware analysis report

Static analysis result for SHA-256 5f1972de469b2d4c…

MALICIOUS

PDF

39.4 KB Authoring application: Mobipocket Creator
MD5: 86e15ea1f3c4db768620f21e7bc3d512 SHA-1: 73d8316221a94c42ae8e513d0dd4fa4445f8ca3d SHA-256: 5f1972de469b2d4c0539a72031f28bafd405ec2f2b3e1ad8afd186e582b62b76
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. ClamAV detection and ML classification strongly indicate maliciousness. The document body, though heavily obfuscated, contains references to 'Edexcel a level maths pure year 2 solutions', suggesting a lure to educational content, which is then redirected to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://krystalmichelle.com/uploads/1/3/0/5/130588473/fisupox_vejefol_nopewirobotonon.pdf
    • http://babystepstosuccessfcc.com/uploads/1/3/0/4/130477663/keduzumuzuvalu.pdf
    • http://xir.cloudycherry.net/uploads/2020/01/29/galixesubesiwi.pdf
    • http://5pointauto.com/uploads/1/3/0/8/130814132/130814132.html#edexcel+a+level+maths+pure+year+2+solutions
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001075.bin
028558698008fc83386352dbb970d613a0a5b12e6a304958e262f55d088e2c2e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1075 9052 bytes
font_01_sfnt_off00005df7.bin
019bfe7d2d26446e11b96ab8a2f7bb7b8b845b08d248b92840400d1836a73571		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DF7 3060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.