Malicious PDF — malware analysis report

Static analysis result for SHA-256 016e52c9748a0971…

MALICIOUS

PDF

44.1 KB Authoring application: pdf-parser First seen: 2020-09-24
MD5: ad00df93bf3f7e3938a8c41bf357648a SHA-1: 680146141156585272ba3eca5f9de84ec4b50f21 SHA-256: 016e52c9748a0971817a538980942684062cda565dfc9899ddb2d70a40c33635
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous embedded URLs that are likely part of a link farm, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly suggest malicious intent, specifically related to phishing. While no scripts were extracted, the presence of malformed streams and the overall structure point towards an attempt to exploit PDF viewers or redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTH
    A PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://waylessepoxyflooring.com/uploads/1/3/0/6/130604527/1272736.pdf In PDF document text
    • http://facialplasticsurgery.tips/uploads/1/3/0/2/130287493/faburufawojebol.pdfIn PDF document text
    • http://cnymariancenter.net/uploads/1/3/0/2/130272369/newisiwu_sekoneku_razupikuk.pdfIn PDF document text
    • http://solerconsulting.com/uploads/1/3/0/6/130604765/bodexijokawopem_metizemezip_talomeganedag_menupixavoli.pdfIn PDF document text
    • http://relaysecurity.com/uploads/1/3/0/4/130488850/130488850.html#accountant+cover+letter+sample+pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10CB 8556 bytes
SHA-256: 655166f23cf1b22f9bac02544feb881d1ff51dda6cdcb4439459c6eaddddc5eb

Open this report in the interactive analyzer, or submit your own file for analysis.