Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ab154595a259e4b…

MALICIOUS

PDF

45.1 KB Authoring application: Nitro PDF First seen: 2020-09-24
MD5: 441aa777fb2abfdea6cb84f94009c310 SHA-1: bd4cd133a741b163f7f123fec5632201022a060b SHA-256: 1ab154595a259e4b315e1c98af4ce71476a6857a8b22e313f6e441bbf5d86bc4
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, a common tactic for phishing or distributing further malware. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or traffic redirection purpose. The embedded URLs likely lead to malicious PDF files or phishing pages designed to harvest user credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mmorrisld.com/uploads/1/3/0/7/130776330/sojiririze.pdf In PDF document text
    • http://www.sacredpathbeauty.com/uploads/1/3/0/5/130546937/molivaraxipu.pdfIn PDF document text
    • http://your-perfect-gift.com/uploads/1/3/0/7/130775735/murabe.pdfIn PDF document text
    • http://bijoumoscow.com/uploads/1/3/0/6/130620863/basirinadobutizikel.pdfIn PDF document text
    • http://www.dustywindowsills.com/uploads/1/3/0/4/130483303/5700322.pdfIn PDF document text
    • http://alliesonthejourney.com/uploads/1/3/0/6/130639862/kijosukanopuvin.pdfIn PDF document text
    • http://chengpoy.com/uploads/1/3/0/6/130604487/d0b611265de.pdfIn PDF document text
    • http://golferselbowkelowna.com/uploads/1/3/0/7/130738633/9322696.pdfIn PDF document text
    • http://iwantoutofokc.com/uploads/1/3/0/7/130776720/lopuvu.pdfIn PDF document text
    • http://hashoutpost.com/uploads/1/3/0/4/130489039/wukumasakozegorefaw.pdfIn PDF document text
    • http://doriensmolders.com/uploads/1/3/0/7/130775923/4513238.pdfIn PDF document text
    • http://gritandgraceboutiqueky.com/uploads/1/3/0/7/130776218/sefofepozo.pdfIn PDF document text
    • http://lucassincasa.com/uploads/1/3/0/2/130270833/9082001.pdfIn PDF document text
    • http://drbrentschillinger.com/uploads/1/3/0/7/130776008/8c7a8.pdfIn PDF document text
    • http://arkansasartpottery.com/uploads/1/3/0/6/130621155/1955c2453.pdfIn PDF document text
    • http://www.singesauceworks.com/uploads/1/3/0/8/130874409/feserejav.pdfIn PDF document text
    • http://mscnbc.com/uploads/1/3/0/2/130274151/62038395d85b6.pdfIn PDF document text
    • http://businessesformedicareforall.org/uploads/1/3/0/9/130969628/6102666.pdfIn PDF document text
    • http://kelsweet.com/uploads/1/3/0/4/130436130/bb29645aa70d.pdfIn PDF document text
    • http://nuthoppers.com/uploads/1/3/0/8/130813899/vaxedetax.pdfIn PDF document text
    • http://www.healingthroughartandmusic.com/uploads/1/3/0/8/130814763/76a0f755f2.pdfIn PDF document text
    • http://cpanel.hogridin.com/uploads/1/3/0/5/130590019/bokisuj.pdfIn PDF document text
    • http://hostmaster.costumeunderground.co.uk/uploads/1/3/0/8/130814145/foregazabol.pdfIn PDF document text
    • http://gardenglassetc.com/uploads/1/3/0/5/130589208/5415650.pdfIn PDF document text
    • http://rcstudios.co.vu/uploads/1/3/0/4/130436513/130436513.html#myrtaceae+family+plants+listIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
🗂 Part of campaign: dustywindowsills.com 4 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000038b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x38B2 7960 bytes
SHA-256: cffe64fc6722b83888d39aa73fb0d5e9ec99a73cec4e0cda5cce23b9135e82fa
font_01_sfnt_off00005378.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5378 16204 bytes
SHA-256: 5df8447ccddf7aa392d42d8154b7ef928f4157a253b0c910c224979b6e97d754

Open this report in the interactive analyzer, or submit your own file for analysis.