Malicious PDF — malware analysis report

Static analysis result for SHA-256 a20bc4747b415905…

MALICIOUS

PDF

37.4 KB Authoring application: Serif PagePlus
MD5: a6896bddd9f091aff7d282891e0078af SHA-1: 479d58331b3a803a73c3712609014644452bd670 SHA-256: a20bc4747b415905ea21db60041c29edb360519c6b31e7876e580d77776773c1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, indicating a link farm designed to direct users to external content. The ClamAV detection and ML classifier strongly suggest malicious intent, specifically identified as phishing and traffic redirection. The heuristic PDF_SEO_LINK_FARM firing confirms the presence of numerous external PDF links, with 'beardedbeaverco.com' being a dominant host. No scripts were extracted from this sample, but the structure and URL distribution point towards a phishing or redirection campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://beardedbeaverco.com/uploads/1/3/0/4/130483819/japevisepi.pdf
    • http://dougtms.com/uploads/1/3/0/3/130323164/rivabagik.pdf
    • http://msmailadministrator.net/uploads/1/3/0/6/130621046/4810741.pdf
    • http://emrekulali.com/uploads/1/3/0/2/130270796/jarusofitum.pdf
    • http://szconstructionweimartx.com/uploads/1/3/0/5/130540559/0706d.pdf
    • http://drrodmackenzie.com/uploads/1/3/0/6/130604434/mobogusarofe-kunuva.pdf
    • http://ccf-ag.org/uploads/1/3/0/2/130289703/5931768.pdf
    • http://www.mannatomic.com/uploads/1/3/0/5/130588922/030537a7.pdf
    • http://hostmaster.rivermethodistchurch.org.uk/uploads/1/3/0/8/130813521/kedunaj_wifuvasugik.pdf
    • http://mrsrosatosclass.com/uploads/1/3/0/6/130620677/kovoxelotebek_tusekagidamasib_rumotoz_vepogoxas.pdf
    • http://shaunadragomir.com/uploads/1/3/0/8/130874612/8133093717a32.pdf
    • http://bellabee.org/uploads/1/3/0/7/130775279/5afc16ee8473.pdf
    • http://worldfamouslasagna.com/uploads/1/3/0/4/130476145/wibukine.pdf
    • http://www.semahadithi.com/uploads/1/3/0/8/130873995/caffe7c.pdf
    • http://213winchesterfarms.com/uploads/1/3/0/6/130604032/rolabafit_dijibirolenuxoz_dugikek_timukujavur.pdf
    • http://loveit-defaultspanish.devsite-1.com/uploads/1/3/0/6/130604561/130604561.html#integer+exponents+common+core+algebra+2+answer+key
    • http://hostmaster.rivermethodistchurch

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003631.bin
0f62ea6cc10346881424f767b7c7747d3a4699c01129552217443ac02488cbf3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3631 8220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.