Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f348022672bb137…

MALICIOUS

PDF

37.0 KB Authoring application: QPDF First seen: 2020-09-24
MD5: 700bc063cd235b512f400838dbae6861 SHA-1: f2c31445943c232d6dfc463aa6876ee6ca19f9d6 SHA-256: 1f348022672bb137b72f55e007387ff5bbf8b5607678ea17b25310eff81fdce3
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection of Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent. The primary goal appears to be directing users to a vast collection of other PDF files hosted across numerous domains, likely for SEO spam or to host phishing content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wuvepineb.weebly.com/uploads/1/3/0/6/130605135/nuwagi-wavazovusope-nipidijovu-woragam.pdf In PDF document text
    • http://valkrieshopgoddess.com/uploads/1/3/0/4/130476575/dabonajaxobene.pdfIn PDF document text
    • http://sjmjkzqpgbkayi.weebly.com/uploads/1/3/0/6/130604602/faluropipimati_ziwowojikafoxi_kejelitu.pdfIn PDF document text
    • http://theletsbehonest.com/uploads/1/3/0/2/130291463/jovipububasep.pdfIn PDF document text
    • http://tentmakers.co/uploads/1/3/0/5/130590538/6245255.pdfIn PDF document text
    • http://mikepaganrealtor.com/uploads/1/3/0/6/130639962/xuduxag-bixijuku.pdfIn PDF document text
    • http://knowltonplacehomes.com/uploads/1/3/0/4/130435667/xosuwukobarewex_jojamol.pdfIn PDF document text
    • http://zewonovem.the-future-company.com/uploads/2020/01/28/vomidewikaxif-bepopipox.pdfIn PDF document text
    • http://racqueteerproshop.com/uploads/1/3/0/4/130478760/pepimobu.pdfIn PDF document text
    • http://nujalikuju.shopdochoi.tech/uploads/2020/01/27/soreze.pdfIn PDF document text
    • http://velobristol.com/uploads/1/3/0/5/130550901/getimis.pdfIn PDF document text
    • http://dikil.boom-trikes.ru/uploads/2020/01/27/94ef83c.pdfIn PDF document text
    • http://clspropertymaintenance.com/uploads/1/3/0/5/130590738/8597256.pdfIn PDF document text
    • https://memopaburox.weebly.com/uploads/1/3/0/5/130551457/bd4f19.pdfIn PDF document text
    • http://vivekiju.efficientenergy.ru/uploads/2020/01/27/libufupopi.pdfIn PDF document text
    • http://activemech.com/uploads/1/3/0/3/130312983/030f4a90f9d9a.pdfIn PDF document text
    • http://spicysnack.com/uploads/1/3/0/5/130551927/wanakosuja.pdfIn PDF document text
    • http://marnimigrealtor.com/uploads/1/3/0/2/130270951/6146791.pdfIn PDF document text
    • http://lijinimax.paypal-support-limitted.com/uploads/2020/01/28/jawubaf.pdfIn PDF document text
    • http://mijoz.remstroi-metal.ru/uploads/2020/01/29/7921761.pdfIn PDF document text
    • http://collier-pave.com/uploads/1/3/0/4/130483417/dujimofanogojuf_lilogatenowut_xovesepabozevo_xewup.pdfIn PDF document text
    • http://grandcentraltradingcompany.com/uploads/1/3/0/3/130323341/23500.pdfIn PDF document text
    • http://airscrubbersales.com/uploads/1/3/0/6/130605165/juvafar-gekegavumibe.pdfIn PDF document text
    • http://fodozu.tele2store.ru/uploads/2020/01/28/sawavizitozex.pdfIn PDF document text
    • http://wusaxifo.on-kot.ru/uploads/2020/01/27/f0712d3f4e0e1.pdfIn PDF document text
    • http://mustardseedmarketinggroup.com/uploads/1/3/0/6/130640133/130640133.html#html+to+pdf+java+mavenIn PDF document text
🗂 Part of campaign: clspropertymaintenance.com 4 samples

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17CC 7720 bytes
SHA-256: 6f34b84d934a45838f59dc544ababd80e6720a2fb8b17d269f93ff25c918c9f1

Open this report in the interactive analyzer, or submit your own file for analysis.