Malicious PDF — malware analysis report

Static analysis result for SHA-256 2630b3bb4865e18e…

MALICIOUS

PDF

72.5 KB Authoring application: PDF Studio First seen: 2020-09-24
MD5: 460dc22f356fceec4db1522b8c150989 SHA-1: 85d13b3bb9f06afc247b24cdeafd284c3f972951 SHA-256: 2630b3bb4865e18e6bc57a57280630ea3e4bc458c8960e5b55ef309b3d6823f7
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or a method to distribute malicious content or manipulate search engine results. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or traffic-driving intent. No scripts were extracted, and the document body is heavily obfuscated, limiting further analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mrsottocounselingcorner.com/uploads/1/3/0/4/130476207/af692a64b2b0a.pdf In PDF document text
    • http://thewardrobesquad.com/uploads/1/3/0/3/130313790/wemumir.pdfIn PDF document text
    • http://fecresources.net/uploads/1/3/0/6/130604215/fikon.pdfIn PDF document text
    • http://hifuckers.com/uploads/1/3/0/4/130479435/kebisezimefivagab.pdfIn PDF document text
    • http://advbiocom.com/uploads/1/3/0/3/130379354/tanefuliwira_gudupulutepu_pulasu_suxef.pdfIn PDF document text
    • http://microschoolontherise.com/uploads/1/3/0/7/130775729/zuvemegod.pdfIn PDF document text
    • http://cleaningservicesresidentialcommercial.com/uploads/1/3/0/5/130551230/25bb23d697517d8.pdfIn PDF document text
    • http://electricianmartincounty.com/uploads/1/3/0/5/130539097/pidawavatifemida.pdfIn PDF document text
    • http://fashionitaly.net/uploads/1/3/0/2/130273735/sibev.pdfIn PDF document text
    • http://sousmarine.de/uploads/1/3/0/5/130543148/7523732.pdfIn PDF document text
    • http://forestavenuemedical.com/uploads/1/3/0/5/130550741/notupivodix-josefotimokole-bofevurazosak.pdfIn PDF document text
    • http://siskiyouespressotech.com/uploads/1/3/0/2/130289523/e1ca52be7d59f2e.pdfIn PDF document text
    • http://premierrecruiting.net/uploads/1/3/0/4/130489833/namevexojotovi.pdfIn PDF document text
    • http://sallykfrey.com/uploads/1/3/0/2/130289799/8061c.pdfIn PDF document text
    • http://sublimepainting.net/uploads/1/3/0/6/130640214/2846ba.pdfIn PDF document text
    • http://zealventures.net/uploads/1/3/0/8/130813757/7512a79.pdfIn PDF document text
    • http://idonutcare.net/uploads/1/3/0/8/130814644/cbd8093673.pdfIn PDF document text
    • http://alanpliuart.com/uploads/1/3/0/6/130639377/38172f39885fb.pdfIn PDF document text
    • http://moodlabnewlife.nl/uploads/1/3/0/5/130551661/130551661.html#oscar+wilde+e+il+ritratto+di+dorian+grayIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000169a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x169A 11400 bytes
SHA-256: ce1abc373ee4ac71b5fc0cc5e6f62b41bd7f3aa557249cd430560ea026bf7a0b
font_01_sfnt_off0000c9b4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC9B4 16132 bytes
SHA-256: 014a06d3ebcab26b292cd89b1c4156f34f806217642b385644bdac287d77828e
font_02_sfnt_off0000de8f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDE8F 3836 bytes
SHA-256: 73db1b0517a03a3ea453c43aa17591918c1b4579ef19e8986c06116ede1a3a54

Open this report in the interactive analyzer, or submit your own file for analysis.