Malicious PDF — malware analysis report

Static analysis result for SHA-256 20d211e8826eea63…

MALICIOUS

PDF

51.6 KB Authoring application: PDFBox First seen: 2020-09-24
MD5: 49b6615f266b556532bd69fed79bfda0 SHA-1: ce4b5dd6a644a1aacc08ec36967308ad296488a8 SHA-256: 20d211e8826eea63d51b73c758f7c6795610890afa334e38c18e86e4ad65433b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm or a phishing campaign designed to distribute malicious content or manipulate search engine results. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://smootherwaters.com/uploads/1/3/0/2/130287972/lalugi-terusopurisiwuz-teteruxewewof-budulesuxurufo.pdf In PDF document text
    • http://westmeetseastcreative.com/uploads/1/3/0/5/130539348/ridanuw.pdfIn PDF document text
    • http://www.contemporary-flair.com/uploads/1/3/0/5/130541028/2638355.pdfIn PDF document text
    • http://www.blessedmoondoula.com/uploads/1/3/0/4/130479435/edb0500cee31770.pdfIn PDF document text
    • http://pebbleandstonetextiles.com/uploads/1/3/0/2/130270781/nawojomutajuga.pdfIn PDF document text
    • http://oneactioncalendar.org/uploads/1/3/0/6/130639516/752472.pdfIn PDF document text
    • http://define-living.com/uploads/1/3/0/9/130969932/8880950.pdfIn PDF document text
    • http://1801innovationblvd.com/uploads/1/3/0/4/130488503/zigunivaw.pdfIn PDF document text
    • http://redfernmarketresearch.com/uploads/1/3/0/6/130604303/raximapa.pdfIn PDF document text
    • http://www.spanishwithflor.org/uploads/1/3/0/7/130738850/fb2ff81b38c.pdfIn PDF document text
    • http://possibilitycourse.org/uploads/1/3/0/7/130738732/xixowozi.pdfIn PDF document text
    • http://biscuitrollers.com/uploads/1/3/0/5/130551125/7659427.pdfIn PDF document text
    • http://brohamas.com/uploads/1/3/0/7/130739301/baduruba.pdfIn PDF document text
    • http://caitlinmorrison.com/uploads/1/3/0/7/130739564/dojedediren.pdfIn PDF document text
    • http://ottica2g.com/uploads/1/3/0/7/130776667/nuziselesobuwibar.pdfIn PDF document text
    • http://adaptiveplanningconsultant.com/uploads/1/3/0/6/130604788/lowavagef_nijotigiti.pdfIn PDF document text
    • http://www.newlifeprestwick.com/uploads/1/3/0/2/130288762/jijumufew.pdfIn PDF document text
    • http://wag-works.com/uploads/1/3/0/5/130588517/4450837.pdfIn PDF document text
    • http://www.laurenvanmullem.com/uploads/1/3/0/6/130639537/356406.pdfIn PDF document text
    • http://audigoodwillpackage.com/uploads/1/3/0/7/130775465/fosekifikupavasibewo.pdfIn PDF document text
    • http://blockinsight.com/uploads/1/3/0/4/130489830/7376400.pdfIn PDF document text
    • http://www.bidmcbreasturgeryfellow.com/uploads/1/3/0/7/130738506/2388092.pdfIn PDF document text
    • http://inbsolucoes.com.br/uploads/1/3/0/8/130814735/83582c1ca.pdfIn PDF document text
    • http://campingdishwasher.com/uploads/1/3/0/4/130483869/vebozegi-ravow.pdfIn PDF document text
    • http://learntosailswf.com/uploads/1/3/0/3/130323962/vulofugavudiga.pdfIn PDF document text
    • http://adsl-63-204-18-42.benefitplans.org/uploads/1/3/0/7/130738712/130738712.html#ejercicios+de+tiempos+verbales+en+ingles+mezclados+con+soluciones+pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004383.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4383 2684 bytes
SHA-256: 1b0b9ccafa3a8d4187e86757028d03de598065db96186c0e11ce259314def278
font_01_sfnt_off00004c6f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4C6F 16036 bytes
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63
font_02_sfnt_off000063cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63CB 8996 bytes
SHA-256: ce5211be287a229754e54e283b40f8b984414552e218c58da62dde3aeb3d93e8

Open this report in the interactive analyzer, or submit your own file for analysis.