Malicious PDF — malware analysis report

Static analysis result for SHA-256 6a8d92d04870f469…

MALICIOUS

PDF

57.8 KB Authoring application: Soda PDF
MD5: 5a46d8135a3c6889d4d0d77acc33df29 SHA-1: db5d37d2a26fec83114d306ebc09b5b452bdd65f SHA-256: 6a8d92d04870f469b64d91a5d722b29386dc0c04f35d2ac78bc5db9c76e051f7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The critical PDF_SEO_LINK_FARM heuristic fired, revealing a mass of external links, with the first being http://midwestlegalpartners.com/uploads/1/3/0/4/130476611/bumibowis-jizedanijibalor-xebivaw.pdf. These links are likely used to redirect users to phishing sites or download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://midwestlegalpartners.com/uploads/1/3/0/4/130476611/bumibowis-jizedanijibalor-xebivaw.pdf
    • http://pobodiki.raphaacupuncture.com/uploads/2020/01/28/nudaxilukebokubej.pdf
    • http://newbusinessdevelopment.net/uploads/1/3/0/2/130287239/rajete_lemozapum.pdf
    • http://yachtrock.biz/uploads/1/3/0/4/130489075/42a1ec1e6ad0.pdf
    • http://dessante.com/uploads/1/3/0/3/130313230/gegubejogiso.pdf
    • http://cityonloc.com/uploads/1/3/0/6/130620528/130620528.html#9.+s%C4%B1n%C4%B1f+kimya+konu+anlat%C4%B1m%C4%B1

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001376.bin
073161755c38dee1917dd53343cbaf9d857557e33777c14e957c695eedf7c52f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1376 9924 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.