Malicious PDF — malware analysis report

Static analysis result for SHA-256 2cc196b09c02696d…

MALICIOUS

PDF

43.9 KB Authoring application: QPDF First seen: 2020-09-24
MD5: 367164fbf6ab9e7fea7bfd2321e15c4e SHA-1: 7876ba98d8c612276f494f7abc8ff3951325712a SHA-256: 2cc196b09c02696d104f1807bd8044d0a556947ea38a107863a014ae4f0141e2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The ML_NYX_PDF_MALICIOUS and CLAMAV_DETECTION heuristics confirm the malicious nature of the file. The embedded URLs suggest a link farm designed to redirect users, likely to phishing sites or to download further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lerevepianos.com/uploads/1/3/0/7/130776478/2ad08c4aeb051.pdf In PDF document text
    • http://mooretre.com/uploads/1/3/0/7/130775261/6430887.pdfIn PDF document text
    • http://sidewalkstour.com/uploads/1/3/0/2/130287504/bovotalurafik.pdfIn PDF document text
    • http://mail.mycraftsweb.com/uploads/1/3/0/2/130287919/sapukeba_xajejix_zepojebanide.pdfIn PDF document text
    • http://weddingcakesbrisbane.net/uploads/1/3/0/3/130379447/parovo_kagevakij.pdfIn PDF document text
    • http://ip107-colo.mnemonix.com/uploads/1/3/0/5/130545199/xedixatasawuteb_rofafi.pdfIn PDF document text
    • http://steelsecuritysystems.net/uploads/1/3/0/4/130435555/nutuvumejavara.pdfIn PDF document text
    • http://pinballalley.ca/uploads/1/3/0/8/130874148/2f4837b849a.pdfIn PDF document text
    • http://angelicapelegrin.com/uploads/1/3/0/5/130543084/jitumapimejazu.pdfIn PDF document text
    • http://cache01.en-linea.com/uploads/1/3/0/7/130739906/7932537.pdfIn PDF document text
    • http://mrsheridanenglish.com/uploads/1/3/0/4/130436166/wubudaz.pdfIn PDF document text
    • http://mycarnabyscooter.com/uploads/1/3/0/6/130621791/zetekidewokesotiwaja.pdfIn PDF document text
    • http://welcometo6h.com/uploads/1/3/0/6/130621915/2042072.pdfIn PDF document text
    • http://ashleydunn.blog/uploads/1/3/0/2/130289319/235b830b.pdfIn PDF document text
    • http://terrasuaka.com/uploads/1/3/0/3/130323523/xelapikilenon.pdfIn PDF document text
    • http://dbtdelaware.com/uploads/1/3/0/4/130475932/vukufirujufe-sebaxamug-mixifesud-tezadete.pdfIn PDF document text
    • http://anteako.com/uploads/1/3/0/7/130776521/d474b7fd1e6af4.pdfIn PDF document text
    • http://yousaved.me/uploads/1/3/0/4/130483390/46e114a37963df0.pdfIn PDF document text
    • http://musingsofageek.com/uploads/1/3/0/5/130589186/6470845.pdfIn PDF document text
    • http://rokuhispano.com/uploads/1/3/0/2/130270996/tiwiv_zuwirisoxugafa_juwizevusoreduk_sisuji.pdfIn PDF document text
    • http://mynutritioninnovation.com/uploads/1/3/0/6/130640094/jivekobeper.pdfIn PDF document text
    • http://thedjfoote.com/uploads/1/3/0/6/130605238/nojijasugasugojagoro.pdfIn PDF document text
    • http://www.lindsaysterling.com/uploads/1/3/0/5/130590779/9291299.pdfIn PDF document text
    • http://www.donna-a-stiles-photographyonline.com/uploads/1/3/0/8/130874612/213bf8ce2.pdfIn PDF document text
    • http://risearise.com/uploads/1/3/0/5/130550742/0b99a.pdfIn PDF document text
    • http://adsl-63-204-18-32.benefitplans.org/uploads/1/3/0/6/130620857/130620857.html#fasciola+hepatica+sizeIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000038dc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x38DC 2652 bytes
SHA-256: e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea
font_01_sfnt_off00004503.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4503 8712 bytes
SHA-256: 2277c07df483ac08e5520054bb54ad9b579d1aab3eb772c6a367659b95f6cadb

Open this report in the interactive analyzer, or submit your own file for analysis.