Malicious PDF — malware analysis report

Static analysis result for SHA-256 2507a805104fb9bd…

MALICIOUS

PDF

39.8 KB Authoring application: Poppler-utils First seen: 2020-09-24
MD5: fa6775ffe552c5259b1425d6ce381c79 SHA-1: aa80f0407807a89093ccd57e0bdb3b5f22908941 SHA-256: 2507a805104fb9bd60b85d159bd241f79e0e7de8b50b6914fe3dfbef46b2bfad
192 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The document body and embedded URLs suggest a lure for downloading remote access software, potentially for malicious purposes. The PDF_SEO_LINK_FARM heuristic indicates a large number of external links, many of which point to PDF files hosted on various domains, suggesting a link farm for distributing malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://wufamefaw.weebly.com/uploads/1/3/0/3/130313000/8aed51ddf54.pdf In PDF document text
    • http://aliveyouthmebc.com/uploads/1/3/0/4/130435937/8e5ef99284.pdfIn PDF document text
    • http://tax.remont-msk4.icu/uploads/2020/01/28/19b7377128a5.pdfIn PDF document text
    • https://pabavusoko.weebly.com/uploads/1/3/0/2/130289179/jomudezejaga.pdfIn PDF document text
    • http://aomhm.org/uploads/1/3/0/2/130270934/kegujez.pdfIn PDF document text
    • http://joeljimenezfashion.shop/uploads/1/3/0/6/130604758/1682364.pdfIn PDF document text
    • http://tubu.ekolutechnologies.com/uploads/2020/01/27/mukavoja.pdfIn PDF document text
    • http://vipiski-besplatno52.icu/uploads/2020/01/28/1416760.pdfIn PDF document text
    • http://mycgexpress.com/uploads/1/3/0/6/130639852/dfb93160b9.pdfIn PDF document text
    • http://chapmanfarrellgroup.com/uploads/1/3/0/2/130272442/3966668.pdfIn PDF document text
    • http://2020blue.org/uploads/1/3/0/5/130551551/130551551.html#descargar+supremo+control+remoto+gratisIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001256.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1256 9052 bytes
SHA-256: 96c5b8b90559753b8d560f294b5ce399786d19d772a453460d7e17d22a899d85
font_01_sfnt_off000052f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x52F0 16500 bytes
SHA-256: 67fc5177fd584259d92df2d04361ee5812aeaf6169251fafb29fd1ddf16900d3

Open this report in the interactive analyzer, or submit your own file for analysis.