Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e07ab77bb4d0933…

MALICIOUS

PDF

72.0 KB Authoring application: Adobe PDF Library 9.0 First seen: 2020-09-04
MD5: 14ee6510c1f3b9f47fc3eb718cc71b9c SHA-1: 190e65c94a70dfa26da8bccd17415e50daab0073 SHA-256: 1e07ab77bb4d0933a4f90810a95d7e35b3e937307409833f94a7cf0f54ee4bc4
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious File: User Execution: Malicious File

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The heuristic PDF_SEO_LINK_FARM specifically identifies this pattern, with the dominant host being newearth.design.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://newearth.design/uploads/1/3/0/5/130544591/6375bd9111868d4.pdf In PDF document text
    • http://montgomerytattoos.com/uploads/1/3/0/7/130775275/22777d21d66fe9a.pdfIn PDF document text
    • http://mindbodymend.com.au/uploads/1/3/0/6/130621852/823007.pdfIn PDF document text
    • http://adultsthemes.com/uploads/1/3/0/7/130739786/c76b014.pdfIn PDF document text
    • http://auroraarearetiredteachersassociation.org/uploads/1/3/0/6/130621831/62b804a.pdfIn PDF document text
    • http://nationalfootballcheerleadersalumni.org/uploads/1/3/0/4/130479044/801f3d6.pdfIn PDF document text
    • http://nashvillebluetones.com/uploads/1/3/0/4/130483895/tetawusax_jofokevefata.pdfIn PDF document text
    • http://gwe-design.com/uploads/1/3/0/4/130488547/wojazivu_varuz.pdfIn PDF document text
    • http://netmassive.net/uploads/1/3/0/2/130272484/bajivem.pdfIn PDF document text
    • http://tonicbagsshoes.com/uploads/1/3/0/6/130639028/b1b1e43a8.pdfIn PDF document text
    • http://nelancasterhub.org/uploads/1/3/0/2/130272600/revus.pdfIn PDF document text
    • http://kristyrackham.com/uploads/1/3/0/2/130272905/bopoli-norodadazar-rakeluxijub.pdfIn PDF document text
    • http://theladsonline.com/uploads/1/3/0/7/130740589/fodudosoxa.pdfIn PDF document text
    • http://executivecareercoachinstitute.com/uploads/1/3/0/6/130605255/fdd446ff51956a.pdfIn PDF document text
    • http://wildlifegardener.org/uploads/1/3/0/2/130271090/xebujuliwudexed.pdfIn PDF document text
    • http://ciumontreal.com/uploads/1/3/0/7/130740184/janux_vikoxozal_savev.pdfIn PDF document text
    • http://katiethompsonestatevineyard.com/uploads/1/3/0/5/130546076/zabisufudixuka_tosin_lekigepirumiki_sokeb.pdfIn PDF document text
    • http://whenapp.com/uploads/1/3/0/5/130543346/e25c59b34437989.pdfIn PDF document text
    • http://moreaction.co/uploads/1/3/0/3/130324351/33d43bbd4d92d68.pdfIn PDF document text
    • http://labcharter-pto.com/uploads/1/3/0/6/130621663/da143c3bd3c1ba.pdfIn PDF document text
    • http://tophatalgarve.com/uploads/1/3/0/2/130289236/puwakifuzefinem.pdfIn PDF document text
    • http://mikewilliamslivemusic.com/uploads/1/3/0/6/130622042/tolumuvufogikix_nagaxo.pdfIn PDF document text
    • http://findingbalanceinuncertaintimes.com/uploads/1/3/0/7/130776295/130776295.html#pediatric+chronic+kidney+disease+nutrition+guidelinesIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000028cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x28CF 9408 bytes
SHA-256: ff8033050fc2e74802c6b737354f543a355334cb04144ad64d8b9f79a1ff217e

Open this report in the interactive analyzer, or submit your own file for analysis.