Malicious PDF — malware analysis report

Static analysis result for SHA-256 23f3f4c05eef907b…

MALICIOUS

PDF

51.0 KB Authoring application: Mobipocket Creator First seen: 2020-09-24
MD5: a8c21fbaa2e16ac191ec98cdfd425212 SHA-1: 821815eaf4ec696f367ee11b20b1336cb6f97958 SHA-256: 23f3f4c05eef907bba81ff26226dd9ea9a9f1b3a14f84149f9d9e6f3c6b2d5f6
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

This PDF file was detected as malicious by ClamAV and an ML classifier, exhibiting characteristics of a phishing or SEO spam campaign. The document contains a large number of embedded URLs pointing to external PDF files, suggesting a link farm or distribution mechanism. The primary intent appears to be directing users to these external resources, potentially for further exploitation or to manipulate search engine rankings.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://brbayouth.com/uploads/1/3/0/2/130271102/d8b555f77caad.pdf In PDF document text
    • http://mtsarmusic.com/uploads/1/3/0/7/130776007/f7d52d258.pdfIn PDF document text
    • http://ncbeertours.com/uploads/1/3/0/6/130639115/xutoxezedede.pdfIn PDF document text
    • http://nrdiamondclub.org/uploads/1/3/0/5/130541103/mavagavazuvut-vijubuxodom.pdfIn PDF document text
    • http://cyber-plus.net/uploads/1/3/0/8/130873875/820aba082.pdfIn PDF document text
    • http://cfthomas.com/uploads/1/3/0/6/130621477/muxuzu.pdfIn PDF document text
    • http://ameskornerstore.com/uploads/1/3/0/5/130589163/f7ffb5724.pdfIn PDF document text
    • http://skunkremovalknoxville.com/uploads/1/3/0/6/130639424/lipuvo.pdfIn PDF document text
    • http://nomadfoodtruck.com/uploads/1/3/0/3/130313098/gigakuvanalivosafe.pdfIn PDF document text
    • http://nwspecialtylumbermill.com/uploads/1/3/0/7/130740363/vixoferizelum.pdfIn PDF document text
    • http://richardforiberiaparishpresident.com/uploads/1/3/0/2/130287977/vegetugujige.pdfIn PDF document text
    • http://advancedrxtestwebsite.com/uploads/1/3/0/7/130739129/dolazomevitizow-zotir.pdfIn PDF document text
    • http://howtobeaweddingcoordinator.com/uploads/1/3/0/5/130551589/1616828.pdfIn PDF document text
    • http://cleanforetagsstad.com/uploads/1/3/0/7/130740492/najev-lifavefakosim-detokidoxujadiv.pdfIn PDF document text
    • http://famcoinsurance.com/uploads/1/3/0/6/130605168/3013542.pdfIn PDF document text
    • http://renmach.com/uploads/1/3/0/2/130287462/kiwagix.pdfIn PDF document text
    • http://charlydigital.org/uploads/1/3/0/7/130739142/soditotosa.pdfIn PDF document text
    • http://quillicus.com/uploads/1/3/0/5/130539479/3ab3e8f0.pdfIn PDF document text
    • http://clean-cooling.org/uploads/1/3/0/5/130588153/wimofiw-wamibukebo-nimufu-debudetisixido.pdfIn PDF document text
    • http://federaltriallitigators.com/uploads/1/3/0/2/130289524/rowadejinur.pdfIn PDF document text
    • http://chironetics.com/uploads/1/3/0/7/130738578/4141190.pdfIn PDF document text
    • http://rhworkplace.com/uploads/1/3/0/7/130775002/lixitev.pdfIn PDF document text
    • http://celebrate-sympathynotes.com/uploads/1/3/0/6/130621324/lifofemepe_sowukokajofuna_kuwobata_dudetib.pdfIn PDF document text
    • http://prolinelifepharmaceutical.com/uploads/1/3/0/6/130620788/pugibifelirujig_xonimijobo_sasawurafukesu_lugejikut.pdfIn PDF document text
    • http://nationalriskmanagementgroup.com/uploads/1/3/0/5/130540897/130540897.html#accredited+private+universities+in+ghana+2019In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010d6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D6 8228 bytes
SHA-256: cbe13a0d639be51ba0c853fa405bb18644b5a4fe4d6022bf7e6c36c0ee59420c

Open this report in the interactive analyzer, or submit your own file for analysis.