Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e9b05dfdfc2f4c0…

MALICIOUS

PDF

86.1 KB Authoring application: Mobipocket Creator First seen: 2020-09-24
MD5: 201a204003b73d4600e593e94dc02e67 SHA-1: ca31e9f478cb6790023955195595dc92a3dcf464 SHA-256: 1e9b05dfdfc2f4c077bb1828834ccbca720573112195b7ade1a710ed2c6b212a
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The critical heuristic 'PDF_SEO_LINK_FARM' indicates the presence of 31 external PDF links, with the primary domain being 'mymvmtpods.com'. This suggests the document's purpose is to act as a lure, directing users to a network of other malicious PDF files, likely for phishing or malware distribution. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9254

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mymvmtpods.com/uploads/1/3/0/5/130550729/fivapikatenu.pdf In PDF document text
    • http://spirituallyyou.life/uploads/1/3/0/5/130550997/nawasibub_lemukopus_golusereguzozuj_wazesijuji.pdfIn PDF document text
    • http://mgtowtv.com/uploads/1/3/0/6/130639017/07de5bf1e81f.pdfIn PDF document text
    • http://mu-danca.com/uploads/1/3/0/2/130288523/1721180.pdfIn PDF document text
    • http://dsy.allstars.org/uploads/1/3/0/6/130604250/3975113.pdfIn PDF document text
    • http://weedeaterridinglawnmower.net/uploads/1/3/0/5/130588931/lujivekupome_rojajo_dajadesasa_buniwe.pdfIn PDF document text
    • http://ashonfood.com/uploads/1/3/0/6/130604552/womin_wulefegev_jefedegi_jemosozazebav.pdfIn PDF document text
    • http://andrewcarlosarchitect.com/uploads/1/3/0/5/130590356/nukenutiduraxan.pdfIn PDF document text
    • http://cybertrainingpro.com/uploads/1/3/0/7/130775704/gekavakutexe.pdfIn PDF document text
    • http://trustedcannabiscfo.com/uploads/1/3/0/2/130270763/8472171.pdfIn PDF document text
    • http://aka108.com/uploads/1/3/0/7/130740522/bisajipulifuka.pdfIn PDF document text
    • http://gcseclub.com/uploads/1/3/0/6/130622009/nuzodi.pdfIn PDF document text
    • http://masonicformation.com/uploads/1/3/0/2/130289581/dawazulem-zijanejoget-tawexazo-zapom.pdfIn PDF document text
    • http://dealershowing.com/uploads/1/3/0/4/130488987/bebefukota.pdfIn PDF document text
    • http://www.lawson-kilauea.com/uploads/1/3/0/4/130483679/vevorofonobemuwu.pdfIn PDF document text
    • http://www.md12658917.com/uploads/1/3/0/8/130813979/c603129a2d.pdfIn PDF document text
    • http://culturallyresponsivesustainedteaching.com/uploads/1/3/0/6/130620769/fegujoteg.pdfIn PDF document text
    • http://tecnialuminios.com/uploads/1/3/0/7/130776886/3264e955e5cd.pdfIn PDF document text
    • http://cadencehealth.co.uk/uploads/1/3/0/7/130776218/domaxujigixujir.pdfIn PDF document text
    • http://solutionfocusedtherapys.org/uploads/1/3/0/7/130776023/desud.pdfIn PDF document text
    • http://nyforceacademy.com/uploads/1/3/0/6/130639092/xoguzimikagezunojeka.pdfIn PDF document text
    • http://youarebow.com/uploads/1/3/0/4/130478106/7296147.pdfIn PDF document text
    • http://makrworld.com/uploads/1/3/0/2/130289620/xonojajexuto.pdfIn PDF document text
    • http://www.fotostudiolw.com/uploads/1/3/0/7/130776295/putuwu.pdfIn PDF document text
    • http://74-123-72-107.mgwnet.com/uploads/1/3/0/6/130604281/130604281.html#apache+open+office+applicationsIn PDF document text
    • http://linux.thai.net/projects/fonts-tlwgIn PDF document text
    • http://www.thaitux.infoIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://www.gnu.org/licenses/lgpl.htmlRegularDanhHongIn PDF document text
    • http://www.geocities.com/dnhhngIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 8

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11A9 11776 bytes
SHA-256: ae6c1cb82df5c50e2aa4bff98a0528789f20d6788fc7e6f934a652ee3dc3fb5e
font_01_sfnt_off00008b64.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8B64 6336 bytes
SHA-256: 57ab9563b93709fdd7a716e21cede2f27f3b6b500259d68a041fdcb0de1a569d
font_02_sfnt_off00009f3e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9F3E 10240 bytes
SHA-256: bbd465158f88620f6b89bbc14fd4053a393fda34b464cf5d9625b9580ee6f51f
font_03_sfnt_off0000b4be.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB4BE 7316 bytes
SHA-256: b1118302c5517eb61a6a239cbb0c0398f36a596cc95e76ebefef7294164c1510
font_04_sfnt_off0000c70d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC70D 5032 bytes
SHA-256: a47959a8a0c44ddf6b8e998b6dd727bd4d99d6980137c168d359ab97f64ba13a
font_05_sfnt_off0000d5bc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD5BC 6664 bytes
SHA-256: 750c92fa1db5810c6de6b1040e9c0837d38486580b44de1cde3f2eb8b8040d63
font_06_sfnt_off0000e682.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE682 3508 bytes
SHA-256: 4c93801c4768b9cf34ec960e4f85d683fdbe353adcc5a9e70f9f8b41c5e92470
font_07_sfnt_off0000f24e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF24E 16860 bytes
SHA-256: a698bf74a6b91010e90e2891ccde8bbe917d6cb64c35f07d6b7285511bd4a274

Open this report in the interactive analyzer, or submit your own file for analysis.