Malicious PDF — malware analysis report

Static analysis result for SHA-256 e3b6c3be5adce2e8…

MALICIOUS

PDF

100.0 KB Authoring application: ImageMagick
MD5: e1305b34d0c74b098630f806c29b5b23 SHA-1: 223355c64192cf97d6b3369942d236d65e5a3fb9 SHA-256: e3b6c3be5adce2e8be8d3215222f08e3d28d1d8af670944233340aa4549ec6e6
152 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of external links, identified as a PDF_SEO_LINK_FARM heuristic. This suggests a phishing or SEO poisoning attack where the document's primary purpose is to redirect users to malicious or deceptive content hosted on external sites. The ClamAV detection and ML classifier further support its malicious nature, indicating it's likely a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fivu.rus-snow.ru/uploads/2020/01/28/6621376.pdf
    • http://mialamaven.net/uploads/1/3/0/6/130620955/9425127.pdf
    • https://lutunadepomonij.weebly.com/uploads/1/3/0/4/130483515/4181101.pdf
    • http://themojo.ru/uploads/2020/01/27/6998725.pdf
    • http://lucette-bijoux.fr/uploads/1/3/0/6/130639895/6790325.pdf
    • http://adriantobin.com/uploads/1/3/0/2/130270907/1580763.pdf
    • http://castlescoins.com/uploads/1/3/0/6/130622036/kuvapoxi_wesatazewi.pdf
    • http://rcbinns.com/uploads/1/3/0/4/130483402/magixoxojosat-mosevorujunigip-vipimevip-mudoripefaz.pdf
    • http://sdgplanning.com/uploads/1/3/0/4/130478004/sifekewazob_fogilerapukida_xalufenure.pdf
    • http://asociacionperiodistaspr.org/uploads/1/3/0/3/130313333/130313333.html#language+acquisition+definition+and+examples

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001406.bin
5cd9e0cf79d3b29d50005f4dc03aa9488305b269f943513efbfb3f059285b883		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1406 9968 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.