PDF malware analysis — malicious · c92badca611c248a

MALICIOUS

PDF

102.2 KB Authoring application: Serif PagePlus

MD5: 20eafac9458b841c0c0cba105b8cbccf SHA-1: d0e8eb1c83a6b58f2edf45e6b74cbd29d5a39cc9 SHA-256: c92badca611c248a9b479ea5c7f5782d79505c4cec6af2427f01eb69346916e1

152 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique commonly used for SEO poisoning or to distribute malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' explicitly identifies the mass linking behavior, with the dominant host being gasotuxomiref.weebly.com.

Machine Learning

Nyx PDF Classifier malicious score 0.9994

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL https://gasotuxomiref.weebly.com/uploads/1/3/0/5/130542982/zodot.pdf
- http://edu6611plc.com/uploads/1/3/0/5/130589278/d2760000.pdf
- http://larsonartgallery.com/uploads/1/3/0/3/130313066/jozexu-nugigodasu-xusujabojit.pdf
- http://newtonanchorbar.co.uk/uploads/1/3/0/5/130589276/9de3b182f633a86.pdf
- http://star-nrg.com/uploads/1/3/0/6/130620469/1231441.pdf
- http://sobolagroup.com/uploads/1/3/0/5/130590082/rifinexofabategop.pdf
- http://mydentalpartner.com/uploads/1/3/0/5/130551551/bc11389.pdf
- https://zafojewun.weebly.com/uploads/1/3/0/2/130289558/mizagoxe.pdf
- http://potafagi.feierverkspb.ru/uploads/2020/01/29/wabate-bopawexope-jomipanolini-rimumad.pdf
- https://dolorurodezit.weebly.com/uploads/1/3/0/5/130550781/rofazed_xonodob_darinepazoto_vokigigu.pdf
- http://sozavid.ichildroom.ru/uploads/2020/01/28/bc272d6.pdf
- http://neufeldvolk.com/uploads/1/3/0/6/130605083/mivuguzapisome.pdf
- http://positivepushkc.com/uploads/1/3/0/2/130271019/somudidivatoz_novedo_vazaj_puvezekigose.pdf
- http://clarksurveyor.com/uploads/1/3/0/4/130483583/4989996.pdf
- http://minedearth.com/uploads/1/3/0/3/130323337/43e8ef0d8ee4c0d.pdf
- http://simplyyogavancouver.com/uploads/1/3/0/3/130313314/8596382.pdf
- http://bastion.co.nz/uploads/1/3/0/3/130379248/gegosisar.pdf
- http://cesartechnologiesltd.com/uploads/1/3/0/4/130477839/guropilej.pdf
- http://internationalschoolformeditationtraining.com/uploads/1/3/0/5/130590420/zufazuzelax-tofonuwo-tefut.pdf
- http://natonee.com/uploads/1/3/0/2/130287289/8dec6169dc2.pdf
- http://akpartnership.org/uploads/1/3/0/6/130639439/jegul_tajilugapobesox_vejegezimi.pdf
- http://avon-lider.com/uploads/2020/01/27/1697644.pdf
- http://msmvpa.weebly.com/uploads/1/3/0/2/130288710/6352328.pdf
- https://gawunigudegivug.weebly.com/uploads/1/3/0/3/130323754/2175979.pdf
- http://juliejesternewman.com/uploads/1/3/0/3/130313105/130313105.html#nice+guidelines+alcohol+withdrawal+seizures

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00001885.bin` `d94824c01a0c2a2b1777762bfe4c12717a35050bb9116d33066a68ab66721573`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x1885	8092 bytes
`font_01_sfnt_off0000e3c7.bin` `41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee`	pdf-font-stream	PDF embedded font (sfnt) at offset 0xE3C7	2600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.