Malicious PDF — malware analysis report

Static analysis result for SHA-256 32664ba4da098498…

MALICIOUS

PDF

40.7 KB Authoring application: ImageMagick First seen: 2020-09-04
MD5: d18c4070de897d569aa6b338431c789b SHA-1: 3214cf490c59e85599637191239fdc153f06a877 SHA-256: 32664ba4da098498fd3c9f4e352a2ffa2f50245045fe3b7ab07f6f404f7dd11f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on various domains, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or distribute additional malicious content. ClamAV also detected this as Pdf.Phishing.TtraffRobotInstall, indicating a phishing or redirection campaign. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nitratodargento.com/uploads/1/3/0/8/130813325/muwosetoje-velewo.pdf In PDF document text
    • http://chasinggrapessocial.com/uploads/1/3/0/8/130813967/wuzevanudu-wemopokate.pdfIn PDF document text
    • http://lubatales.com/uploads/1/3/0/5/130551176/ridimubibuzumop.pdfIn PDF document text
    • http://www.alexhernandezlawfirm.com/uploads/1/3/0/7/130775448/nuvakuxuvis-zukubomaki-moxipefirotide.pdfIn PDF document text
    • http://wind-surfing.com/uploads/1/3/0/2/130271103/4588836.pdfIn PDF document text
    • http://reklam5.net/uploads/1/3/0/2/130287456/lexelirulixomumi.pdfIn PDF document text
    • http://connelyhitnews.com/uploads/1/3/0/7/130775111/vipipadusa_nilavex.pdfIn PDF document text
    • http://blazinginformatics.com/uploads/1/3/0/5/130588221/2792925.pdfIn PDF document text
    • http://peru.cctvradio.com/uploads/1/3/0/7/130776478/4728883.pdfIn PDF document text
    • http://lapen.us/uploads/1/3/0/2/130272387/gaxeveloroxu.pdfIn PDF document text
    • http://mta-sts.babydreamsmc.com/uploads/1/3/0/2/130272934/gemalesolor.pdfIn PDF document text
    • http://catswearitsat.com/uploads/1/3/0/4/130483902/jujozipilaru.pdfIn PDF document text
    • http://callthemformeprototype.com/uploads/1/3/0/4/130483198/a82a1.pdfIn PDF document text
    • http://mail.mrmiraclesflooring.com/uploads/1/3/0/3/130323672/gadijo_nafufowujoxat_xubak.pdfIn PDF document text
    • http://gloriousdiamond.com/uploads/1/3/0/6/130621622/877067a7e63e6d.pdfIn PDF document text
    • http://n122ld.com/uploads/1/3/0/7/130738970/verigunirudi.pdfIn PDF document text
    • http://noahcompportfolio.com/uploads/1/3/0/2/130271030/lenobexetuzapene.pdfIn PDF document text
    • http://joanvanhoy.com/uploads/1/3/0/6/130622110/948fc91305.pdfIn PDF document text
    • http://volnaiskra.com/uploads/1/3/0/2/130289315/pimotofux_lilobegukinalom.pdfIn PDF document text
    • http://castawaycustomsmidwest.com/uploads/1/3/0/7/130776066/zagiwa.pdfIn PDF document text
    • http://lucaligorio.com/uploads/1/3/0/7/130776262/39de19cc428b2f.pdfIn PDF document text
    • http://tuijian.bpmtc.com/uploads/1/3/0/8/130874254/130874254.html#acer+aspire+one+nav50+chargerIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003034.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3034 2596 bytes
SHA-256: 87fd6b1a35a64f5c2d30902eea89631a9c05d6b36ef70c6d0cee4d2ad867525e
font_01_sfnt_off00003c05.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3C05 8736 bytes
SHA-256: a40c0ec4f55a36a9c78e91dbc81c28b4ec033fb099663b1f993c3653984573e1

Open this report in the interactive analyzer, or submit your own file for analysis.