Malicious PDF — malware analysis report

Static analysis result for SHA-256 36988e47153ea28e…

MALICIOUS

PDF

41.6 KB Authoring application: Serif PagePlus First seen: 2020-09-24
MD5: b2e6962532bd67ae22bf97a9f252a176 SHA-1: 8d8331dda9ce1fa79da1220a2d4b73f7c6f4c75b SHA-256: 36988e47153ea28e821112d40cedc35428b266c464e6a7b82c27eaf8ac0dfbd9
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to host malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and URL farm suggest a phishing or content-distribution lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://classicmassagestudio.com/uploads/1/3/0/5/130588678/d4f8fc58576.pdf In PDF document text
    • http://nourishmentinmotion.com/uploads/1/3/0/5/130588459/rukujikov_wowigitake_kowununu.pdfIn PDF document text
    • http://artworkrunner.com/uploads/1/3/0/6/130604688/pomaruxepiv.pdfIn PDF document text
    • http://ckholland19.com/uploads/1/3/0/2/130271097/logimi_tusadapapugoz_notozefumokup.pdfIn PDF document text
    • http://ingridholmtranslations.com/uploads/1/3/0/2/130289172/japuwepafelonu.pdfIn PDF document text
    • https://tufememulu.weebly.com/uploads/1/3/0/5/130590143/9527987.pdfIn PDF document text
    • http://sakoloxova.maturitas.ru/uploads/2020/01/27/fitumolifuj_nagesaba_guwezoviremedax.pdfIn PDF document text
    • http://domisolka.net/uploads/1/3/0/5/130541065/penijanoduzamud_kilotu_fidunoka.pdfIn PDF document text
    • http://catwalknailsalon.com/uploads/1/3/0/5/130539120/f6db9f.pdfIn PDF document text
    • http://mountainviewmentalhealth.com/uploads/1/3/0/4/130483146/puwotokev.pdfIn PDF document text
    • https://benawamu.weebly.com/uploads/1/3/0/4/130435857/tujere.pdfIn PDF document text
    • http://brittanycandice.com/uploads/1/3/0/4/130483491/8527201.pdfIn PDF document text
    • http://1481skyview.com/uploads/1/3/0/3/130313358/9691182.pdfIn PDF document text
    • http://mylifeinconchas.com/uploads/1/3/0/2/130288348/duvawigulu.pdfIn PDF document text
    • http://sose.studymoves.com/uploads/2020/01/27/zesexop.pdfIn PDF document text
    • http://jozibestwomensclinic.com/uploads/1/3/0/4/130476442/konisujemap_pezesadag_wexutogebun.pdfIn PDF document text
    • http://unlawfullytasty.com/uploads/1/3/0/5/130539366/9b29a387.pdfIn PDF document text
    • http://msseven16.com/uploads/1/3/0/6/130621908/8323102.pdfIn PDF document text
    • http://xova.kiamotors.md/uploads/2020/01/28/4519188.pdfIn PDF document text
    • http://evq.ro/uploads/1/3/0/4/130483856/3863bc3a41010.pdfIn PDF document text
    • https://latesasexeka.weebly.com/uploads/1/3/0/5/130539672/fuvafino-xozokopizezowe-zotexaxu.pdfIn PDF document text
    • http://jotovelipi.knb-games.pw/uploads/2020/01/29/xejisufis.pdfIn PDF document text
    • http://airflowjourney.com/uploads/1/3/0/5/130588675/togijelarojil.pdfIn PDF document text
    • http://normanbrickandmasonry.com/uploads/1/3/0/6/130604101/31ac633e9ceec.pdfIn PDF document text
    • http://moses-michael.com/uploads/1/3/0/6/130603767/zebuni.pdfIn PDF document text
    • http://bernardobellostudio.com/uploads/1/3/0/6/130603983/130603983.html#login+page+angularjs+templateIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001810.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1810 8668 bytes
SHA-256: 191b3c930e355f936a5199fbaa84205484c58b4a061559d0afebd019a7df0eb5

Open this report in the interactive analyzer, or submit your own file for analysis.