Malicious PDF — malware analysis report

Static analysis result for SHA-256 1f97520db1620a61…

MALICIOUS

PDF

41.1 KB Authoring application: Pdftk First seen: 2020-09-24
MD5: e3f7a092c9b6ba180c060648b38d8b16 SHA-1: 1183a34a7cfbd99078797654c2e3268ef835ed2c SHA-256: 1f97520db1620a61ef9e3a6397b12df4f0b1f10a058917f4c7163bcca92cd3d9
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' confirms the presence of numerous external PDF links, with 'riseupgroup.net' being a dominant host. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://riseupgroup.net/uploads/1/3/0/5/130541462/8905205.pdf In PDF document text
    • http://a1412531xstreamtravel.xsideas.com/uploads/1/3/0/2/130287462/bejapo.pdfIn PDF document text
    • http://nounoula.com/uploads/1/3/0/2/130287920/9504905.pdfIn PDF document text
    • http://phoenixadjusters.net/uploads/1/3/0/3/130379718/mofezuj_tivaxuloriveg_fetumev.pdfIn PDF document text
    • http://yournaturallybrightpatiocovers.com/uploads/1/3/0/5/130547418/gomunalewurim.pdfIn PDF document text
    • http://joeblitzstein.net/uploads/1/3/0/2/130274345/kenekekapozid.pdfIn PDF document text
    • http://liftoffgames.com/uploads/1/3/0/6/130604114/c80d6d1ac89.pdfIn PDF document text
    • http://tillercapitalltd.com/uploads/1/3/0/4/130483396/zevaxi-tunipil.pdfIn PDF document text
    • http://iveyvoicestudio.com/uploads/1/3/0/6/130604588/mopap.pdfIn PDF document text
    • http://4saules.lv/uploads/1/3/0/5/130544390/7367985.pdfIn PDF document text
    • http://goldiefoxcreativeconsulting.com/uploads/1/3/0/7/130739431/08e6832d8d04983.pdfIn PDF document text
    • http://docpixelphotography.com/uploads/1/3/0/5/130551197/74621.pdfIn PDF document text
    • http://mianduimianshipinqipaiyouxi.br3h.com/uploads/1/3/0/8/130873718/130873718.html#eat+right+for+your+blood+type+o+negativeIn PDF document text
🗂 Part of campaign: cjentzart.com 7 samples

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000048fc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x48FC 7928 bytes
SHA-256: 4bfe23bc12b24366b39b92f8e86ec8c1de8e2c08f539eaa44328d5e79f078a6d

Open this report in the interactive analyzer, or submit your own file for analysis.