Malicious PDF — malware analysis report

Static analysis result for SHA-256 92e8bdce3c01ed52…

MALICIOUS

PDF

38.5 KB Authoring application: PDFBox
MD5: be433e72033cea90aa900be85472dd10 SHA-1: 148d42310a23813b1d1f332a19453d9b2b968e90 SHA-256: 92e8bdce3c01ed520980c0a23a87d85c16fcb8a263c676505c630041d2d6b998
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical finding for a link farm and a ClamAV detection for phishing. The embedded URLs and the PDF structure indicate a malicious intent to redirect users to external sites. The document body, though partially corrupted, mentions 'ICAS Mathematics' and 'test prep course', suggesting a lure to trick users into clicking the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://merakiofferings.com/uploads/1/3/0/6/130639664/dizafazudof.pdf
    • http://rejowu.oracul.pro/uploads/2020/01/29/1492933.pdf
    • http://scopehomeinspection.com/uploads/1/3/0/5/130551191/acb71edeb6456.pdf
    • http://occseagles.org/uploads/1/3/0/3/130323733/mekereliwexegabikur.pdf
    • http://voj.freemservice.com/uploads/2020/01/28/de48786fac4.pdf
    • http://supergrasslawn.com/uploads/1/3/0/5/130551064/sumasegiluxog_nudowawafasufot_miwopumu_kojusuj.pdf
    • http://brewandplowfarm.com/uploads/1/3/0/4/130477661/a9e6fa5f4c8c.pdf
    • http://teamclm.com/uploads/1/3/0/6/130639275/0f59ecd.pdf
    • http://alliancerestorationkc.com/uploads/1/3/0/6/130621944/tejaguw.pdf
    • http://csobecancour-en.com/uploads/1/3/0/4/130483062/vulonipazoguk_tonidavewemo_waxuvekimalas_jodal.pdf
    • http://momochieikaiwa.jp/uploads/1/3/0/6/130620557/9200895.pdf
    • http://2304raventrail.com/uploads/1/3/0/4/130478295/saxakizuvejujap-sakuronaje-vusiwidazidok.pdf
    • http://cecilyeiferle.com/uploads/1/3/0/5/130590511/130590511.html#icas+mathematics+2018+answers

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001365.bin
b6ad17b690f865338f89a2bad0f0b1bfe82be4fcf468a7c21cd14c4d4771f367		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1365 7792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.