Malicious PDF — malware analysis report

Static analysis result for SHA-256 f5d7469ce00d6cf9…

MALICIOUS

PDF

50.7 KB Authoring application: Serif PagePlus First seen: 2020-09-24
MD5: 1a3b74b036825e9b2972326867f9864d SHA-1: 0aef8195426bdfe6aff60ae0aa2f0522555ed4a9 SHA-256: f5d7469ce00d6cf996af3045bf4152eddadc50e16adad594c08117eb7973cb06
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, identified as a link farm, and is flagged by ML classifiers and ClamAV as malicious phishing content. The document body, though partially corrupted, contains references to 'GATE Application Form 2020' and login pages, suggesting a lure to harvest credentials or redirect users to malicious sites. The embedded URLs are likely used to host phishing pages or download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • MFA / one-time-code harvesting lure high SE_MFA_LURE
    Document asks for a one-time code, authenticator approval, or MFA confirmation — consistent with credential phishing kits that steal session tokens or abuse multi-factor authentication
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://zuzonu.audiostart78.icu/uploads/2020/01/29/lubowaxagarali-xuruk-zoruf-wisejenalerew.pdf In PDF document text
    • https://sasurejojutim.weebly.com/uploads/1/3/0/2/130270974/fexova.pdfIn PDF document text
    • http://alyssapack.com/uploads/1/3/0/6/130604466/646353.pdfIn PDF document text
    • http://cocominksstore.com/uploads/1/3/0/5/130539203/vezovepumotovixomeso.pdfIn PDF document text
    • http://lamosproductions.org/uploads/1/3/0/6/130621997/6979319.pdfIn PDF document text
    • http://zudimuwep.7artllc.com/uploads/2020/01/28/f18786150fe.pdfIn PDF document text
    • http://highchance.top/uploads/2020/01/28/1907888.pdfIn PDF document text
    • http://joescottportfolio.com/uploads/1/3/0/3/130324191/9880a3af04c202e.pdfIn PDF document text
    • http://viwiroz.atrilmedia.com/uploads/2020/01/27/1289673.pdfIn PDF document text
    • https://wotomumotegiko.weebly.com/uploads/1/3/0/6/130604519/4b68e37de00.pdfIn PDF document text
    • http://topsales24.ru/uploads/2020/01/28/siwixizijopetag-durasofobejize-fabiroti.pdfIn PDF document text
    • http://chayachef.com/uploads/1/3/0/5/130544072/bafapu.pdfIn PDF document text
    • http://pup.lebosma.ru/uploads/2020/01/28/d6a6bb36a.pdfIn PDF document text
    • https://wujusazagejum.weebly.com/uploads/1/3/0/2/130287428/8e928dbd91.pdfIn PDF document text
    • http://ledudo.savich.pro/uploads/2020/01/27/vufokuzanak_fonudefimetolob_kewepesuketuw.pdfIn PDF document text
    • http://ccpstl.org/uploads/1/3/0/5/130588257/b752472.pdfIn PDF document text
    • http://kixep.paytosite.icu/uploads/2020/01/27/vonowa_wulujilulefe_ziduzakivosuk.pdfIn PDF document text
    • http://evokefitness.net/uploads/1/3/0/2/130287842/130287842.html#gate+form+2020+candidate+loginIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012d3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D3 9092 bytes
SHA-256: c610e87cbe5b37c7a6cd7ecb357dc4ad9bdf3f28a8cd164770ddc0a87595d01d
font_01_sfnt_off000080cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x80CC 16268 bytes
SHA-256: 5d7ebd720715cd86529581f1d40cc643f68465477bd430d4be5ff736bc95f798