Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a95f760d4674399…

MALICIOUS

PDF

39.8 KB Authoring application: QPDF First seen: 2020-09-24
MD5: f593cc16325f8273ed6f03fd8f694555 SHA-1: b9f05d418e66937055f377d02da4a2d149698fb9 SHA-256: 1a95f760d467439930729406b6aa7e315929d215eaca92b3e9199435f0f9879e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files hosted on various domains. This suggests a link farm or a distribution mechanism for further malicious content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious classification. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://plantcityhomesforsale.net/uploads/1/3/0/7/130739897/6771162.pdf In PDF document text
    • http://kitchensdoorsanddrawers.com/uploads/1/3/0/5/130541023/3254270.pdfIn PDF document text
    • http://insidedentalequipment.com/uploads/1/3/0/8/130874264/tuwadizoso_tilumapo_bawomujez_vepunub.pdfIn PDF document text
    • http://dimensionalfinancialservices.com/uploads/1/3/0/3/130379379/kikivupi-gifunim-witixurafimaf.pdfIn PDF document text
    • http://session9photography.com/uploads/1/3/0/7/130776077/1798263.pdfIn PDF document text
    • http://www.vapes4veterans.com/uploads/1/3/0/5/130588931/vegilel.pdfIn PDF document text
    • http://naughtybottom.net/uploads/1/3/0/2/130274098/e2f56fd4f6557.pdfIn PDF document text
    • http://missionalentrepreneur.com/uploads/1/3/0/5/130550833/dulem.pdfIn PDF document text
    • http://thetrixxband.com/uploads/1/3/0/5/130540085/4743002.pdfIn PDF document text
    • http://vacavillelimos.com/uploads/1/3/0/5/130543106/3016680.pdfIn PDF document text
    • http://seattleyouthbaseball.com/uploads/1/3/0/4/130492127/8875cd9c703343e.pdfIn PDF document text
    • http://pdxart.net/uploads/1/3/0/8/130813577/janunesulasok.pdfIn PDF document text
    • http://jnrconstruction.net/uploads/1/3/0/7/130739048/daludeba.pdfIn PDF document text
    • http://jeaninewhiteunlockinggreatness.com/uploads/1/3/0/2/130291561/mumirebir-menadafa-dejadodajeveta-devim.pdfIn PDF document text
    • http://astaplescarpenterforhireinc.com/uploads/1/3/0/4/130476035/wimalumilowugawi.pdfIn PDF document text
    • http://axispoint.co/uploads/1/3/0/4/130490053/1268189.pdfIn PDF document text
    • http://rampantgames.net/uploads/1/3/0/6/130640107/zelagegoluraxaj_napevovuditu.pdfIn PDF document text
    • http://nzbriards.com/uploads/1/3/0/2/130288757/masujofamuxuk.pdfIn PDF document text
    • http://kid-o-quotes.com/uploads/1/3/0/6/130621552/6237398.pdfIn PDF document text
    • http://919.bpmtc.com/uploads/1/3/0/4/130483804/130483804.html#email+sending+resume+and+cover+letter+sampleIn PDF document text
🗂 Part of campaign: astaplescarpenterforhireinc.com 7 samples

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003bad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3BAD 8308 bytes
SHA-256: 9286eae67fd127d575ad390aad5d0917c503b1e31c4e567c18a571fb0fedb479