Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d382d6a4d719efd…

MALICIOUS

PDF

37.3 KB Authoring application: Mobipocket Creator First seen: 2020-09-24
MD5: 21f581d0378cea5a6870cc10c38b30a9 SHA-1: 05837cfc4dfe23ee98edb300fb321a7ae0236bef SHA-256: 2d382d6a4d719efdad0566788eaf5271de1f7f3b0d50810049884429d2148d3e
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier strongly indicate malicious intent. The document body, though partially corrupted, contains the phrase 'Tummy pains pregnancy symptoms' and lists numerous URLs, suggesting a lure to external content. The primary attack pattern involves directing users to a network of linked PDF documents hosted on various domains.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://merakidestinationmanagement.com/uploads/1/3/0/5/130589145/3441458.pdf In PDF document text
    • http://rentalspacificgrove.com/uploads/1/3/0/6/130621141/gufemofedujituzez.pdfIn PDF document text
    • http://maoriart.org/uploads/1/3/0/6/130604639/dudat.pdfIn PDF document text
    • http://fumid.synweshare.com/uploads/2020/01/29/rebebuviw_lanaxuvarab_dulir_xotoliveb.pdfIn PDF document text
    • https://kulovegubitoga.weebly.com/uploads/1/3/0/5/130588968/xipekujasisel-vikami-xozukekeroje-fazoparalodigad.pdfIn PDF document text
    • http://biglifecc.com/uploads/1/3/0/5/130542822/286e19d3687d28.pdfIn PDF document text
    • http://nadiaberyl.fr/uploads/1/3/0/5/130551387/8894750.pdfIn PDF document text
    • http://dipiudesign.eu/uploads/1/3/0/4/130477152/8658197e1f405.pdfIn PDF document text
    • http://achomecleaningservices.com/uploads/1/3/0/3/130324126/torivololulataj.pdfIn PDF document text
    • http://angiemoll.com/uploads/1/3/0/5/130588203/5236216.pdfIn PDF document text
    • http://antiviruseprotectserviceonline.site/uploads/1/3/0/8/130813913/130813913.html#tummy+pains+pregnancy+symptomsIn PDF document text
🗂 Part of campaign: angelajobin.com 4 samples

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000127e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x127E 7656 bytes
SHA-256: ede6d67e5f75db56953a27ac2be1e99c2e1623533f5ce9617ec9779d19c4fe6e

Open this report in the interactive analyzer, or submit your own file for analysis.