Malicious PDF — malware analysis report

Static analysis result for SHA-256 396cf04457555d07…

MALICIOUS

PDF

52.5 KB Authoring application: Nitro PDF First seen: 2020-09-07
MD5: 4698ac960020d4eba4d27503839d2369 SHA-1: 9df7232acca9f1ec390191bb0777cd04cba9ca5a SHA-256: 396cf04457555d0733d1bfe514575d80bfc5ab37d7ad82b4c5dd99b4a5ef20b8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files hosted across numerous domains. This behavior is indicative of a link farm, likely used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9995

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://introducingfriends.net/uploads/1/3/0/7/130739713/795ff0.pdf In PDF document text
    • http://prenupcounsel.net/uploads/1/3/0/5/130590698/1d7e7a57e.pdfIn PDF document text
    • http://annaravenscroft.com/uploads/1/3/0/3/130313145/manojikaxobet.pdfIn PDF document text
    • http://3mfarmandranch.com/uploads/1/3/0/6/130621596/werofigow-jizuxo.pdfIn PDF document text
    • http://nerdysecretsinside.online/uploads/1/3/0/2/130289550/5934761.pdfIn PDF document text
    • http://www.we2cangrow.com/uploads/1/3/0/5/130551745/mosoted.pdfIn PDF document text
    • http://michellerosa.org/uploads/1/3/0/6/130620519/fabosixos-jiwot-sexosajav.pdfIn PDF document text
    • http://mspledgersclass.com/uploads/1/3/0/6/130604336/8032961.pdfIn PDF document text
    • http://chrysalisholistics.com/uploads/1/3/0/7/130739326/2971571.pdfIn PDF document text
    • http://www.parknorthdesigns.com/uploads/1/3/0/3/130323423/wubajikoxenilopameja.pdfIn PDF document text
    • http://kpmhs.com/uploads/1/3/0/5/130590613/4396950.pdfIn PDF document text
    • http://theaccountantthatlovestech.com/uploads/1/3/0/7/130775734/kavolevila-bijop-rozemumojisilon.pdfIn PDF document text
    • http://franckinvest.com/uploads/1/3/0/6/130621932/fc0fc24.pdfIn PDF document text
    • http://skeletonsoutofthecloset.com/uploads/1/3/0/5/130547884/wefutovozelelavebivu.pdfIn PDF document text
    • http://myketoquest.com/uploads/1/3/0/4/130489418/6a740b413a.pdfIn PDF document text
    • http://northeastgridironpromotions.com/uploads/1/3/0/6/130621959/f3cb7e116c0abdb.pdfIn PDF document text
    • http://unikornandco.com/uploads/1/3/0/7/130775527/fabuziwefa.pdfIn PDF document text
    • http://nataliekfitness.com/uploads/1/3/0/6/130605166/kupitag-xitefuz.pdfIn PDF document text
    • http://sublimeart.co.nz/uploads/1/3/0/5/130588393/vosomizokasi.pdfIn PDF document text
    • http://www.departmentofdoughnuts.com/uploads/1/3/0/8/130874458/8967846.pdfIn PDF document text
    • http://mommieceoapparel.com/uploads/1/3/0/7/130775652/pumozabemimer.pdfIn PDF document text
    • http://create-a-tree.com/uploads/1/3/0/5/130539798/1135185.pdfIn PDF document text
    • http://www.rachelfleischmann.com/uploads/1/3/0/2/130270823/mufuj-babibi.pdfIn PDF document text
    • http://niakohimura.com/uploads/1/3/0/7/130775198/27361b62499cc1.pdfIn PDF document text
    • http://wellosophy.com/uploads/1/3/0/4/130483187/3297587.pdfIn PDF document text
    • http://79.bpmtc.com/uploads/1/3/0/8/130814591/130814591.html#uretritis+por+clamidia+diagnosticoIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004537.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4537 3112 bytes
SHA-256: ec19bfd940b2fcfdec683db9b5653c87b173124bda2e7f39d0ae1eb7bcacec89
font_01_sfnt_off00004f6d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4F6D 16192 bytes
SHA-256: 6d339afc6a78fbfcca0319c110a55134b4027f7ef506b24a2eb2e0a831d1c235
font_02_sfnt_off0000679b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x679B 8932 bytes
SHA-256: 9833d1abd2980c311f73c2210bf0ee77f3b2185497f5e0302093cfff2eeab231

Open this report in the interactive analyzer, or submit your own file for analysis.