Malicious PDF — malware analysis report

Static analysis result for SHA-256 76197cad1a8250a5…

MALICIOUS

PDF

30.2 KB Authoring application: Serif PagePlus
MD5: da6dc1634e4e4eb4da7538197d947058 SHA-1: a8db286f8c3fe01126535d67fc8faca167e0f42a SHA-256: 76197cad1a8250a5391b532db94f2ba33a97548fcc52a7e6da319476ff440dc8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute further malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as phishing-related malware. No scripts were extracted, and the document body is heavily obfuscated, making it difficult to determine the exact lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.wayfarerschapelvideo.com/uploads/1/3/0/4/130435851/lebejob_pevabu_zitirosurifen.pdf
    • http://www.atx360.net/uploads/1/3/0/4/130476050/dipozikejev.pdf
    • http://themusiclaboratory.com/uploads/1/3/0/7/130775321/147435edd5a2.pdf
    • http://firstimpressionautobx.com/uploads/1/3/0/5/130588732/877f277820f0ebc.pdf
    • http://mail.besjaggerd.com/uploads/1/3/0/7/130776123/razuwuvowogoz_naribepipibej_kigiwivewezipil_biletewadademi.pdf
    • http://www.dentist-agency.com/uploads/1/3/0/6/130604633/bodasarumejura.pdf
    • http://aurorachimney.com/uploads/1/3/0/6/130620981/mutaworuwaxisif-wukoje-poriguderolof.pdf
    • http://www.simixacceramiccoating.com/uploads/1/3/0/7/130739475/c45cfefbf85.pdf
    • http://www.futures-op.club/uploads/1/3/0/7/130776300/1973175.pdf
    • http://stalktwit.com/uploads/1/3/0/8/130813120/nebib_napixufese_pudobumaw.pdf
    • http://bastion.co.nz/uploads/1/3/0/5/130539881/05ab2140261.pdf
    • http://precisionroofingok.com/uploads/1/3/0/3/130324005/vatarodum-kosulikapu.pdf
    • http://8ccer.bpmtc.com/uploads/1/3/0/3/130323227/130323227.html#add+in+pdf+word+2007+download

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001fa0.bin
89c803e6e672ed211954fa4fc052eaf354b46a34df1969c49856e2ee9cf6045d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1FA0 7056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.