Malicious PDF — malware analysis report

Static analysis result for SHA-256 da5eb7e8ad834978…

MALICIOUS

PDF

35.9 KB Authoring application: Serif PagePlus
MD5: 04b3311986e8a0f8112115faa2081051 SHA-1: 72530925405bfd95f4d9237648a27d003f9976ac SHA-256: da5eb7e8ad834978dc1f2c113d25a85cebd443fc8377efd84d1252c338bb0021
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical alert for a PDF link farm and ClamAV detection as phishing malware. The document body contains numerous external PDF links, suggesting a tactic to distribute or obscure malicious content. The primary attack pattern involves directing users to a large number of external PDF files hosted on various domains.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nw7.me/uploads/1/3/0/5/130543537/ridedizor.pdf
    • http://www.ordinarymarvels.net/uploads/1/3/0/6/130639349/tapiliga.pdf
    • http://www.elizabethalderfer.com/uploads/1/3/0/4/130483368/3055389.pdf
    • http://www.m-dsurplus.com/uploads/1/3/0/6/130639537/xufip.pdf
    • http://villamklima.com/uploads/1/3/0/5/130545581/ninajutapes.pdf
    • http://machinegunrentals.net/uploads/1/3/0/6/130640006/gedakuxesexo.pdf
    • http://experiencekailua.com/uploads/1/3/0/2/130270987/f5c4e1a181f208.pdf
    • http://www.vegetariangrosirkitchen.com/uploads/1/3/0/7/130739750/xonozixuponuraz.pdf
    • http://thirdi.site/uploads/1/3/0/3/130313057/gelibomusigogaso.pdf
    • http://district1.net/uploads/1/3/0/7/130776640/mobiwijoxatefibufi.pdf
    • http://jenfowler.net/uploads/1/3/0/2/130288321/besunididupo-jomisifum-dufugujovozip-xuxanusazuba.pdf
    • http://paulmelas.co.uk/uploads/1/3/0/6/130604542/lijapugi-firizogifudetaz-pozelekarop-nivavaxofuvor.pdf
    • http://motusbehaviors.com/uploads/1/3/0/6/130621022/mapuvadajefi_kelunexugutox_pivisufeguf_zadof.pdf
    • http://4pwcrv.bdgct.com/uploads/1/3/0/4/130489128/130489128.html#black+sabbath+war+pigs+lyrics+chords

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000026ae.bin
42fcd496a831ff4a4f0ef925959f7ebffc788105b2e886095ce58ff1effacc30		 pdf-font-stream PDF embedded font (sfnt) at offset 0x26AE 8640 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.