Malicious PDF — malware analysis report

Static analysis result for SHA-256 35d05cadab2551c0…

MALICIOUS

PDF

39.8 KB Authoring application: Nitro PDF First seen: 2020-09-24
MD5: 276fe19ad22b594526302713d3ddc76e SHA-1: f544b8db5fb96fbb2da1c11e8c8b82fb06e5a00b SHA-256: 35d05cadab2551c08f3ec4ef7d2ccc77a2c6b0be8a29323be29d7bea80b89d4e
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to host phishing content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support a malicious classification. The document body was heavily obfuscated and truncated, preventing a more detailed analysis of its specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kingdomdvlpr.com/uploads/1/3/0/6/130603841/ninazakakezek_lugalojugutinen_melujopedex.pdf In PDF document text
    • http://astrologyandcrystallighttherapy.com/uploads/1/3/0/6/130621805/4013609.pdfIn PDF document text
    • http://erlamb.com/uploads/1/3/0/6/130604077/motusidovol_pameg_nubusi_gekeketerejufir.pdfIn PDF document text
    • http://scottsvalleyorthodontist.com/uploads/1/3/0/3/130313582/bamusejirevewugami.pdfIn PDF document text
    • http://tokped.services/uploads/1/3/0/6/130639244/jarerur-pevamololuki-dobuxodebitaj-soxofog.pdfIn PDF document text
    • http://finleybroswood.com/uploads/1/3/0/5/130543813/6262d646f.pdfIn PDF document text
    • http://wickedricks.com/uploads/1/3/0/8/130814070/wevibelegiwuz-bekerewezixego-kugirijejeki.pdfIn PDF document text
    • http://normanbrickandmasonry.com/uploads/1/3/0/2/130270971/a999aba0.pdfIn PDF document text
    • http://email.trufitpersonaltraining.com/uploads/1/3/0/7/130776167/mosejexivosev_nemojo_ritimazif.pdfIn PDF document text
    • http://konahypnosis.com/uploads/1/3/0/4/130476598/xebudaba_muwera_gejosadogegowo_mikozi.pdfIn PDF document text
    • http://moshathestylist.com/uploads/1/3/0/4/130435959/jofeke.pdfIn PDF document text
    • http://www.calvarycommunitychurchlancaster.com/uploads/1/3/0/3/130323959/6e69c970b812.pdfIn PDF document text
    • http://gretchenandgustavo.com/uploads/1/3/0/5/130552053/ziwosarunozu-jagowenorud.pdfIn PDF document text
    • http://www.azizfallnetworks.services/uploads/1/3/0/8/130874314/377346.pdfIn PDF document text
    • http://stubblefieldhoa.com/uploads/1/3/0/7/130738697/sitives-zabosipiralax.pdfIn PDF document text
    • http://chaloulosekdromes.com/uploads/1/3/0/3/130323339/81ba2259bb85.pdfIn PDF document text
    • http://1901ironworks.org/uploads/1/3/0/5/130550833/xakipowot_nesiraronega_kupavazizi_tumurawur.pdfIn PDF document text
    • http://kylielyall.com/uploads/1/3/0/2/130287371/kikogigu.pdfIn PDF document text
    • http://shizenfurniture.com/uploads/1/3/0/4/130476143/38ebcb5.pdfIn PDF document text
    • http://tevaalliance.org/uploads/1/3/0/2/130289601/8439467.pdfIn PDF document text
    • http://www.trails4tailsfest.org/uploads/1/3/0/6/130620505/dawowukosidabude.pdfIn PDF document text
    • http://thegooroogroup.com/uploads/1/3/0/5/130545985/lizanit.pdfIn PDF document text
    • http://oeufrier.ca/uploads/1/3/0/6/130639541/8707076.pdfIn PDF document text
    • http://www.ashleyhronek.com/uploads/1/3/0/6/130621503/sepapubamezu.pdfIn PDF document text
    • http://parisinternationaldebutanteball.com/uploads/1/3/0/3/130313196/gugawis_lifajem_winabupuxuwom.pdfIn PDF document text
    • http://xingheyulechengguanwang.br3h.com/uploads/1/3/0/3/130313145/130313145.html#noun+clause+test+ydsIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003561.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3561 8820 bytes
SHA-256: 0c190a3dc75c86c9efe555af52cd9c81c1538d7c714a35bc703d8f967f210140

Open this report in the interactive analyzer, or submit your own file for analysis.