Malicious PDF — malware analysis report

Static analysis result for SHA-256 2b7d3c41a62c2c0d…

MALICIOUS

PDF

76.7 KB Authoring application: Mobipocket Creator First seen: 2020-09-07
MD5: 51a7e2560fe4017f6efd6efe7e8f146e SHA-1: ab5549f3a6ca3dd66c689e6f2501b5dbfdddb01f SHA-256: 2b7d3c41a62c2c0d02e668910d5b04109d61dca654aa602fbb1197b323060329
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. ClamAV also detected this file as Pdf.Phishing.TtraffRobotInstall, indicating a phishing or traffic-generation intent. The embedded URLs likely lead to further malicious content or phishing pages. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9976

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.realfinancialcoach.com/uploads/1/3/0/6/130604320/nixurez-tukep.pdf In PDF document text
    • http://chadallers.com/uploads/1/3/0/6/130639875/xejemelizidum_ketiwokogap.pdfIn PDF document text
    • http://createpowtoon.com/uploads/1/3/0/3/130313220/mewevudozogos_rawokamazema_supoxu.pdfIn PDF document text
    • http://elizabethbrowndesign.com/uploads/1/3/0/7/130775833/1284885.pdfIn PDF document text
    • http://catering.abc.it/uploads/1/3/0/7/130776536/106c23e545c.pdfIn PDF document text
    • http://nuezdejabon.com/uploads/1/3/0/2/130287514/1698651.pdfIn PDF document text
    • http://zuada.org/uploads/1/3/0/5/130588907/sesuzugokaverog.pdfIn PDF document text
    • http://buysellbell.com/uploads/1/3/0/7/130775862/5032493.pdfIn PDF document text
    • http://weilerandborst.com/uploads/1/3/0/7/130739210/xezunexezexip_pinijobolupifo_puwax.pdfIn PDF document text
    • http://helenshanks.org/uploads/1/3/0/7/130739766/7540943.pdfIn PDF document text
    • http://www.creditschooltuescueladecredito.com/uploads/1/3/0/5/130551704/novibofodawope_tukalufupabewav_rogimi.pdfIn PDF document text
    • http://www.lucianaluna.com/uploads/1/3/0/3/130313294/pepuwopesegubunamepi.pdfIn PDF document text
    • http://mail2.gandpdesigns.com/uploads/1/3/0/9/130969498/nepijavas-bopir-fugur.pdfIn PDF document text
    • http://www.ancilliaryconsultinggroup.com/uploads/1/3/0/6/130603855/7830713.pdfIn PDF document text
    • http://workingclasskids.com/uploads/1/3/0/4/130435909/kumigasowukidebus.pdfIn PDF document text
    • http://arkstore.shop/uploads/1/3/0/7/130738821/panijebuson-novavurapawe.pdfIn PDF document text
    • http://bearsvsbabiesgame.net/uploads/1/3/0/2/130274291/7803658.pdfIn PDF document text
    • http://nazga.org/uploads/1/3/0/6/130620154/rojaminixulap_maxavajusaw.pdfIn PDF document text
    • http://northalabamavinylspecialists.com/uploads/1/3/0/6/130604517/pigemanidulasoz.pdfIn PDF document text
    • http://slightedgedesign.com/uploads/1/3/0/2/130289519/3162388.pdfIn PDF document text
    • http://www.iowabirthactivists.org/uploads/1/3/0/4/130476086/e3eb22215.pdfIn PDF document text
    • http://www.selenialimited.com/uploads/1/3/0/6/130603747/7727400.pdfIn PDF document text
    • http://suzanne-bond.org/uploads/1/3/0/4/130478760/lofigisil.pdfIn PDF document text
    • http://mingateachers.com/uploads/1/3/0/7/130738629/suxusekumumuzixa.pdfIn PDF document text
    • http://mgeducationfund.org/uploads/1/3/0/5/130551684/5251379.pdfIn PDF document text
    • http://webmail.gammaxiques.org/uploads/1/3/0/4/130488227/130488227.html#html5+embed+pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003203.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3203 2652 bytes
SHA-256: 1b3f82cd74c5b6671cc0c0d4a6c7877b74bb57ca469b2a61ef541918e41af838
font_01_sfnt_off00003f15.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3F15 44100 bytes
SHA-256: 68398ad25d6ae2d5782061c34e4c79e7811746959f3c91a565b678fa1dcd66cc
font_02_sfnt_off0000c5a8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC5A8 9288 bytes
SHA-256: 8ba228cfde4a2106d501216aebec2d036464a88c4c94d895e0f933a77f3d36b4

Open this report in the interactive analyzer, or submit your own file for analysis.