Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7e83739f0b7a3e5…

MALICIOUS

PDF

49.3 KB Authoring application: Serif PagePlus
MD5: 0340060f4b88a6f84987fd2f169459b3 SHA-1: fec9bfff3c4c5f2132f7e2b21472c31d9f1851d5 SHA-256: b7e83739f0b7a3e531757539cde52a41e485f6f86ed2377c61c15777f43a9da4
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The primary attack pattern observed is a link farm, directing users to numerous external PDF files hosted across various domains. The embedded URL list suggests a coordinated effort to distribute content, potentially for SEO manipulation or to serve as a distribution point for further malware. The PDF structure itself does not contain exploitable content but serves as a vehicle to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theladsonline.com/uploads/1/3/0/5/130538922/robevej.pdf
    • http://fita.pay-pass.pro/uploads/2020/01/28/ninipefomujuza-logideregik-jidorowunoliwa.pdf
    • http://newportplant.com/uploads/1/3/0/5/130588775/kafumuxof_gabaxebonekuk_jisebu_kofafutanukapiz.pdf
    • http://pavanmehat.com/uploads/1/3/0/5/130550948/6ebab.pdf
    • http://summitatrailroadsquare.com/uploads/1/3/0/6/130605476/660154.pdf
    • http://guitarhugs.com/uploads/1/3/0/4/130435602/dizowezabo.pdf
    • http://theluxycloset.online/uploads/1/3/0/6/130605475/noguru.pdf
    • http://vicbellbeats.com/uploads/1/3/0/6/130605124/pukibaxa_piwanodomexuno.pdf
    • http://scstrainingofohio.com/uploads/1/3/0/7/130739656/3a7e98c.pdf
    • http://ingeniouspictures.com/uploads/1/3/0/4/130490115/gusareforuboj_rejonidu_rijogiminaf.pdf
    • http://barbsplacehome.com/uploads/1/3/0/4/130475994/4843405.pdf
    • http://nuobeijing.devsite-1.com/uploads/1/3/0/2/130289630/130289630.html#l

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001438.bin
edcf49ef4ab10e55692f5b5105c88512254ea22c764d31c59e2953cef8cbb694		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1438 9672 bytes
font_01_sfnt_off0000601f.bin
01708a0c7c542303b6fd4582ae1c28df9f29a0f8c4cd7f1eb07a7c2569cdbd29		 pdf-font-stream PDF embedded font (sfnt) at offset 0x601F 4388 bytes
font_02_sfnt_off00006d75.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6D75 2652 bytes
font_03_sfnt_off0000769e.bin
be779845c7882e5f270278afd2db9f12db94865136bc396692d1c2f490622fed		 pdf-font-stream PDF embedded font (sfnt) at offset 0x769E 17084 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.