Malicious PDF — malware analysis report

Static analysis result for SHA-256 a5d78da741901557…

MALICIOUS

PDF

47.4 KB Authoring application: pstoedit
MD5: 1d0d6393002d63a27fbe4bef6ca56552 SHA-1: d072151fec44d89e13d2f18dcafd0a0f820da295 SHA-256: a5d78da7419015579d36006e87ebf97287f252e396bdd5e788d9aae80aa7d89e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple heuristics, including ClamAV and a machine learning classifier, for containing a large number of external links. The heuristic PDF_SEO_LINK_FARM specifically indicates a link farm structure, suggesting the primary purpose is to redirect users to potentially malicious sites. The embedded document body text is heavily obfuscated and does not provide clear intent, but the overall structure points to a phishing or malware distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://windowrestorationspecifications.com/uploads/1/3/0/6/130604319/5819939.pdf
    • http://recoverylouisville.com/uploads/1/3/0/2/130271167/towojawakopotok.pdf
    • http://mangocitrus.ca/uploads/1/3/0/5/130588487/516426.pdf
    • http://womackiron.info/uploads/1/3/0/4/130488401/ce35c94ab2a6250.pdf
    • http://npsmonkey.net/uploads/1/3/0/6/130605044/2935490.pdf
    • http://gaymer.tv/uploads/1/3/0/7/130740151/3457404.pdf
    • http://cedarlanesucculents.com/uploads/1/3/0/2/130289177/7836281.pdf
    • http://supportingdaz.com/uploads/1/3/0/6/130621211/fudekipobusodawafe.pdf
    • http://rosepalmerlaw.com/uploads/1/3/0/6/130621035/tonaxivomorowom.pdf
    • http://maparadis.com/uploads/1/3/0/7/130775563/dotak-ralifiger-razuli-litezexewu.pdf
    • http://portalfinanciero.net/uploads/1/3/0/5/130544413/zadutavepavejam_xoxanisatufufef.pdf
    • http://phudicin.com/uploads/1/3/0/7/130739935/soxawew_sozuwirutivuban_sumavabe.pdf
    • http://bsa-sccc-pack301.com/uploads/1/3/0/6/130620423/130620423.html#pleural+fluid+transudate
    • http://recoverylouisville.com/uploads/1/3/0/2/1302

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004783.bin
fc0bcc9d08d908b8b1287d0ab2df4e3a5be78b1d1690d8efe3ff9d2c54ab5679		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4783 16064 bytes
font_01_sfnt_off00005f61.bin
0e4c699d53ef11ef284de5a27e490affbed0fb41a4630f192c39317fd7d21b6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F61 9032 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.