Malicious PDF — malware analysis report

Static analysis result for SHA-256 36261aee5323ad16…

MALICIOUS

PDF

44.9 KB Authoring application: PDFedit First seen: 2020-09-04
MD5: a5bf79b1c3306d07bc6dc1319c54b6cc SHA-1: 7122bcc1c54c49f002c042de1d9663ff6d778408 SHA-256: 36261aee5323ad16892ae167cf7574218b1e6a7259129bc44896e51235634f8f
172 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell T1566.002 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and a machine learning model, indicating a high likelihood of malicious intent. The PDF contains an embedded JavaScript stream and a large number of external PDF links, suggesting it is part of a link farm designed to redirect users to malicious content. The document body, though partially corrupted, contains text related to accounting interview questions and includes numerous URLs, reinforcing the phishing or redirection lure. The primary attack pattern involves using a seemingly legitimate document to trick users into accessing and potentially downloading further malicious files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Malformed active-content stream length medium PDF_MALFORMED_EXPLOIT_STREAM_LENGTH
    A PDF stream that carries active/exploit-looking content has a declared /Length that does not match the recovered stream body. Malformed stream boundaries and length mismatches are common parser-evasion/supporting evidence around Reader exploit streams.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://vukerikokuw.weebly.com/uploads/1/3/0/5/130551534/1a4fa117f71.pdf In PDF document text
    • http://kanomtravel.com/uploads/2020/01/28/1838287.pdfIn PDF document text
    • https://vukerikokuw.weebly.com/uploads/1/3/0/5/130551534/36f4e44ef674.pdfIn PDF document text
    • https://ripizaxavanol.weebly.com/uploads/1/3/0/6/130603824/givuxojoz.pdfIn PDF document text
    • http://deto.klubok-kolobok.ru/uploads/2020/01/27/logojifumevite.pdfIn PDF document text
    • http://bolew.mega-blog7.ru/uploads/2020/01/27/donewila.pdfIn PDF document text
    • http://finug.kc-x.ru/uploads/2020/01/28/6d6be4905742e.pdfIn PDF document text
    • https://ronojanakut.weebly.com/uploads/1/3/0/4/130436224/3520203.pdfIn PDF document text
    • http://gradnia.ru/uploads/2020/01/27/8624099.pdfIn PDF document text
    • http://mor.gdetabletka.ru/uploads/2020/01/29/79b019bc23.pdfIn PDF document text
    • http://numaluvuf.familiarizarse.info/uploads/2020/01/28/lubur.pdfIn PDF document text
    • http://weri.mimosaweb.com/uploads/2020/01/27/riwalukaluzotoju.pdfIn PDF document text
    • http://tanaguz.onkologicheskaya-patalogiya-i-eco.ru/uploads/2020/01/27/kubijiletib_vovigiwulevi.pdfIn PDF document text
    • http://dgsfjhgj.top/uploads/2020/01/28/1340669.pdfIn PDF document text
    • http://faithmirror.com/uploads/2020/01/28/6666490.pdfIn PDF document text
    • https://vimozewolamivo.weebly.com/uploads/1/3/0/6/130604326/6498110.pdfIn PDF document text
    • http://roud-like.ru/uploads/2020/01/28/kanisugi.pdfIn PDF document text
    • https://jojazuvisanipe.weebly.com/uploads/1/3/0/5/130544872/zilinab_gibuduvib_gajimifa.pdfIn PDF document text
    • https://gakegobadesumes.weebly.com/uploads/1/3/0/3/130323612/5997549.pdfIn PDF document text
    • https://bomuwowawon.weebly.com/uploads/1/3/0/5/130588842/sikenokilale.pdfIn PDF document text
    • http://xagawibo.cncsnab.ru/uploads/2020/01/28/d15599.pdfIn PDF document text
    • http://gossort.com/uploads/2020/01/27/nuvekaraluduxigevim.pdfIn PDF document text
    • http://originallamp.ru/uploads/2020/01/27/kixolufedulu.pdfIn PDF document text
    • http://pavlogradgallery.ru/uploads/2020/01/27/7b79b63059609a0.pdfIn PDF document text
    • http://lapaginadelreloj.com/uploads/1/3/0/2/130289732/130289732.html#basic+accounting+questions+asked+in+interview+pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000169a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x169A 8304 bytes
SHA-256: dabe6fe9e5d39a57686b8a92a5f01847721cc5a586d6f36b23bd7cd6e682276a

Open this report in the interactive analyzer, or submit your own file for analysis.