Malicious PDF — malware analysis report

Static analysis result for SHA-256 809f5f95256dc51c…

MALICIOUS

PDF

56.0 KB Authoring application: Solid Converter PDF
MD5: 7119b90fc32dcd2966f591af88fb7b0b SHA-1: 552ec2625f228f8c94c1474e825c04af0c3aa614 SHA-256: 809f5f95256dc51c016d001d2479c397153787d91ad41ace5b7b302f50d870ee
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded links to other PDF files hosted on various domains, suggesting a link farm or redirection mechanism. The document body, though partially corrupted, mentions 'Hard quantitative aptitude questions pdf', indicating a lure to download further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://amksecurities.com/uploads/1/3/0/2/130273913/noxog_nowumoneme_boridemevisogi.pdf
    • http://alimosphere.com/uploads/1/3/0/6/130603988/7996705.pdf
    • http://docmarksrun.com/uploads/1/3/0/6/130603944/8556457.pdf
    • http://karali.trokot-shops.pro/uploads/2020/01/29/601a97d.pdf
    • http://newspechomes.com/uploads/1/3/0/6/130639327/9529404.pdf
    • http://vinoreservado.com/uploads/1/3/0/2/130291769/2693852.pdf
    • http://naukajazdywroclaw.com.pl/uploads/1/3/0/3/130379522/6accd2c14c1.pdf
    • http://nkfanexperience.com/uploads/1/3/0/7/130739169/fe5e70b0dd10.pdf
    • http://trentriverdesigns.com/uploads/1/3/0/3/130379380/130379380.html#hard+quantitative+aptitude+questions+pdf
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000126d.bin
52e82dcf814e175619eedb2e208634a960e3f79c806cfffdb159f945e7cdc164		 pdf-font-stream PDF embedded font (sfnt) at offset 0x126D 9640 bytes
font_01_sfnt_off00008b83.bin
392c0c5eee1700edb56545c228c9187b1dc290a088a16296be7b1ba6a26b78f6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8B83 2964 bytes
font_02_sfnt_off00009517.bin
9a2e38ed526ea6c2202af5fd39b43008b19e81619e20bec9db0c0eecbd0c47e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9517 16152 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.