Malicious PDF — malware analysis report

Static analysis result for SHA-256 2f81ee540fc91883…

MALICIOUS

PDF

49.9 KB Authoring application: Pdftk First seen: 2020-09-24
MD5: 3fc31b98fc417f1c497cbd6627783055 SHA-1: 75d2283880434fff2539acdd66874a34a40875d2 SHA-256: 2f81ee540fc91883fe964113b7f1d791dad000dbd7e3b058f0ad0b7a61916c7c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent. The document body itself is largely corrupted but contains a few of the same URLs, suggesting the primary function is to redirect users to these external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://promyvkapto.ru/uploads/2020/01/28/7ab299eba94b.pdf In PDF document text
    • http://repor.rostelekomu.info/uploads/2020/01/27/29c55c8d01921.pdfIn PDF document text
    • http://sosutuj.thepeacerailway.org/uploads/2020/01/28/7830965.pdfIn PDF document text
    • https://wawowidemikejij.weebly.com/uploads/1/3/0/3/130323255/tupofubinaf.pdfIn PDF document text
    • http://sogukeb.myshop14.site/uploads/2020/01/28/1c1ace869c.pdfIn PDF document text
    • http://mufeto.antlermediagroup.com/uploads/2020/01/27/b9b0768777.pdfIn PDF document text
    • http://totachi-fs.com/uploads/2020/01/27/satovizujusoloma.pdfIn PDF document text
    • http://myta-salon.ru/uploads/2020/01/28/11664b.pdfIn PDF document text
    • http://sapifepig.kekleads.com/uploads/2020/01/27/550eb8c3.pdfIn PDF document text
    • https://bapuvujupa.weebly.com/uploads/1/3/0/4/130435721/gotabixetaguzudatodo.pdfIn PDF document text
    • https://xidobawap.weebly.com/uploads/1/3/0/2/130272880/pegudar_kawojumonedax_tijibuzidozoza.pdfIn PDF document text
    • http://vol.owenwilson.ru/uploads/2020/01/28/momudubo.pdfIn PDF document text
    • https://jafatelozalotiz.weebly.com/uploads/1/3/0/3/130324440/1596714.pdfIn PDF document text
    • https://gamavikemaf.weebly.com/uploads/1/3/0/4/130435982/delanijatimo.pdfIn PDF document text
    • http://kuhnimsc09.icu/uploads/2020/01/27/vakadevukewejesogo.pdfIn PDF document text
    • https://levikujakezodu.weebly.com/uploads/1/3/0/4/130476821/tunumof.pdfIn PDF document text
    • https://xupivilotana.weebly.com/uploads/1/3/0/5/130589205/ragup_waxeb.pdfIn PDF document text
    • https://kijetozev.weebly.com/uploads/1/3/0/5/130588921/gedipedidusixij.pdfIn PDF document text
    • https://gononojonomera.weebly.com/uploads/1/3/0/2/130288818/5e09c.pdfIn PDF document text
    • https://xepulaxiwisi.weebly.com/uploads/1/3/0/4/130475982/fumibobavivutu.pdfIn PDF document text
    • https://sabobasu.weebly.com/uploads/1/3/0/5/130550774/8809941.pdfIn PDF document text
    • https://fuzuzotagoma.weebly.com/uploads/1/3/0/4/130490609/9576929.pdfIn PDF document text
    • https://renerinefebegu.weebly.com/uploads/1/3/0/4/130476880/jofusojajafisa_kolexemuse_bepikupegumasep.pdfIn PDF document text
    • https://vovupudafilavom.weebly.com/uploads/1/3/0/2/130291572/fa1403d44.pdfIn PDF document text
    • http://suto.sex-club.icu/uploads/2020/01/27/vuvukevavetupesiga.pdfIn PDF document text
    • https://rafilaluxonijew.weebly.com/uploads/1/3/0/4/130476150/130476150.html#maroon+5+payphone+guitar+tabIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000178e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x178E 8880 bytes
SHA-256: 14c9d3d62a241c0dceaf2ec600905c98af43e34808f32b0956322d9d3d63d079
font_01_sfnt_off0000643a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x643A 17272 bytes
SHA-256: 543ea37dd0619e831564a05ba11b62f2c842d615ec18ce62519132594d3beaa9
font_02_sfnt_off00007bed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7BED 2780 bytes
SHA-256: fc3ae2e2fd13c4598c99fc86560c5bf2df2b60abb185afad6d5c6e18d06892e1

Open this report in the interactive analyzer, or submit your own file for analysis.