Malicious PDF — malware analysis report

Static analysis result for SHA-256 3df412c9d8e8ba8b…

MALICIOUS

PDF

57.3 KB Authoring application: QPDF First seen: 2020-09-04
MD5: 3cab229b9cf7575a6e76a5baac098461 SHA-1: 4238b762dab14e716b3d1db4134ab335f13d34dc SHA-256: 3df412c9d8e8ba8bdfb7897c212a3c6a578496c6b7ac6ba8d1264a18ae55ab12
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic, suggesting an attempt to manipulate search engine results or redirect users to malicious sites. ClamAV also detected this file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', reinforcing its malicious nature. The presence of a 'SE_DOWNLOAD_BUTTON' heuristic further indicates a lure to encourage user interaction with the embedded links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://solarenergybrokerinc.com/uploads/1/3/0/5/130588279/botekorov-gumaz-welosavifupupan.pdf In PDF document text
    • http://jamesmustafa.com/uploads/1/3/0/8/130874389/mumeganekege.pdfIn PDF document text
    • http://bottegavesuviana.com/uploads/1/3/0/2/130289448/f624a7d89.pdfIn PDF document text
    • http://mindbodyhealthcoaching.com.au/uploads/1/3/0/5/130550681/2525537.pdfIn PDF document text
    • http://www.carlyberg.com/uploads/1/3/0/3/130313161/9879478.pdfIn PDF document text
    • http://heythatsagreatidea.com/uploads/1/3/0/3/130313471/vebojuwetera-ledijav.pdfIn PDF document text
    • http://www.catch5alive.com/uploads/1/3/0/3/130323479/zanodowudakuv.pdfIn PDF document text
    • http://thechurchchoirloft.com/uploads/1/3/0/5/130539446/305975.pdfIn PDF document text
    • http://fakeangels.space/uploads/1/3/0/7/130739143/vilixekabobij-povur.pdfIn PDF document text
    • http://www.sense-mindful.com/uploads/1/3/0/6/130605012/33de8ed0c01.pdfIn PDF document text
    • http://pitwagner.com/uploads/1/3/0/8/130874536/871322.pdfIn PDF document text
    • http://online-wealth-college.com/uploads/1/3/0/2/130270903/69b85.pdfIn PDF document text
    • http://daniel-stripedtiger.com/uploads/1/3/0/2/130291783/4506181.pdfIn PDF document text
    • http://neurology-u-tokyo.com/uploads/1/3/0/7/130775904/buvivalokurafedu.pdfIn PDF document text
    • http://tirus.io/uploads/1/3/0/5/130551562/fodamuvaroxa.pdfIn PDF document text
    • http://mrsrosatosclass.com/uploads/1/3/0/3/130323437/refagaz.pdfIn PDF document text
    • http://thewaves.site/uploads/1/3/0/9/130969278/tevuwidizotuzikolinu.pdfIn PDF document text
    • http://wavradio.org/uploads/1/3/0/6/130640091/779674.pdfIn PDF document text
    • http://quantuminstruments.com/uploads/1/3/0/8/130813373/ec125d16.pdfIn PDF document text
    • http://huangguanwangxiazhujidian.f18.ebkf.org/uploads/1/3/0/6/130605440/tabupaza-gukogugos.pdfIn PDF document text
    • http://animalcomeback.com/uploads/1/3/0/6/130621191/5681481.pdfIn PDF document text
    • http://a1982767xstreamtravel.xsideas.com/uploads/1/3/0/3/130313336/130313336.html#kaplan+f5+revision+kit+2018In PDF document text
    • http://linux.thai.net/projects/fonts-tlwgIn PDF document text
    • http://www.thaitux.infoIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
🗂 Part of campaign: pitwagner.com 4 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003c8d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3C8D 18060 bytes
SHA-256: 696bdcee8fbc902021214a3f19b685da097fb690f390baee6290127e8b477be5
font_01_sfnt_off0000583c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x583C 15784 bytes
SHA-256: 17c16ceb714385a5d8506e469f96300699ff97667f077ddd4d29b41a33b7472b
font_02_sfnt_off00007e73.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7E73 8552 bytes
SHA-256: 9c3812b1e2b75f09abe844c6e7fe5e6a65d6b42e2211a549512a161182d83f6b

Open this report in the interactive analyzer, or submit your own file for analysis.