Malicious PDF — malware analysis report

Static analysis result for SHA-256 5fed1a6d9250554d…

MALICIOUS

PDF

37.3 KB Authoring application: GIMP
MD5: 3a075949967005c40d1e41db2aa51330 SHA-1: e9bc96740ecd7e27b2907c288dc47b83ec180b09 SHA-256: 5fed1a6d9250554d2d73f10c8d1dbd536ba56282016d2d0ad6a3d51636af79a0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded URLs pointing to other PDF files across various domains, indicative of a link farm or a distribution mechanism. ClamAV and ML classifiers also flagged this file as malicious, specifically identifying it as a phishing or spam-related PDF. While no scripts were explicitly extracted, the structure suggests an attempt to redirect users to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.cortonajazz.eu/uploads/1/3/0/6/130639215/jewimokunasugu.pdf
    • http://bigboymoverstest.club/uploads/1/3/0/6/130621043/313838.pdf
    • http://proautocareers.com/uploads/1/3/0/6/130604550/fogupu.pdf
    • http://notallroses.com/uploads/1/3/0/6/130604977/121737.pdf
    • http://tmandersonauthor.com/uploads/1/3/0/5/130588571/gupiviwavo_fafin_mitivuwuliv_rikakulanod.pdf
    • http://crosshopefellowship.org/uploads/1/3/0/6/130605044/mezufuxonulumigogagi.pdf
    • http://msblaw.net/uploads/1/3/0/5/130545021/lunujazoloj.pdf
    • http://toomuchyakkin.com/uploads/1/3/0/3/130323109/xififetokisitewev.pdf
    • http://secure-building.com/uploads/1/3/0/4/130476896/63adb78de8b5b3.pdf
    • http://m.transformationlifecoaching.net/uploads/1/3/0/6/130604841/973b27725c.pdf
    • http://theperpwalk.com/uploads/1/3/0/4/130488141/b6382e81e7000d.pdf
    • http://mmdpgames.com/uploads/1/3/0/6/130604162/5fb575e.pdf
    • http://andreaortega.com/uploads/1/3/0/7/130775280/mofakaxifogalu.pdf
    • http://uniquelyyourslandscapes.com/uploads/1/3/0/3/130324227/nikelasovage_gopum_wemebij.pdf
    • http://jasontfisher.com/uploads/1/3/0/3/130313638/padonibanezawa.pdf
    • http://zunlongguojijulebu.br3h.com/uploads/1/3/0/2/130272081/6754df4a719d387.pdf
    • http://bashfitness.com.au/uploads/1/3/0/3/130379266/xeluxejivepi.pdf
    • http://barringtonmiddleschoolpto.com/uploads/1/3/0/3/130323293/begonam_dofawovanugu.pdf
    • http://divi-expert.com/uploads/1/3/0/4/130436007/divolam-wepoziburemojub-sitiwere.pdf
    • http://healthyhairformula.com/uploads/1/3/0/7/130775619/senutanemilisoxedi.pdf
    • http://drivenwildmn.com/uploads/1/3/0/7/130740148/ziwilikumuzu.pdf
    • http://improperetta.net/uploads/1/3/0/2/130272330/pedakuvelijunugized.pdf
    • http://promptremittance.net/uploads/1/3/0/3/130313507/82b0bcb8516775.pdf
    • http://cruisecatline.com/uploads/1/3/0/6/130639537/sulesakupu.pdf
    • http://naturaltolife.com/uploads/1/3/0/4/130489226/130489226.html#jspdf+fromhtml+react

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c46.bin
b6dd03fbe66da7af9c352a326bb391c948aad8f0f98bb9ebac076113dc7dd433		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C46 8524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.