Malicious PDF — malware analysis report

Static analysis result for SHA-256 461e8f2683c36848…

MALICIOUS

PDF

53.8 KB Authoring application: SWFTools First seen: 2020-09-24
MD5: 92a3fbea47bf5203a76f36da68625630 SHA-1: c8884fa589bbcfb557febe272bfa9df9bd506f96 SHA-256: 461e8f2683c36848e3959ca12db0ec178dfe432a3273fc46642fa69e463afa7b
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a link farm, directing users to multiple external PDF files hosted on various domains. The document body presents a fake error message related to Android Studio, a social engineering tactic to trick users into clicking the malicious links. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and malware distribution intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClickFix social engineering attack high SE_CLICKFIX
    Document instructs the user to press Win+R or paste a command into a terminal — consistent with ClickFix attacks that bypass macro restrictions by tricking users into running malicious commands directly
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://xikizuroxakan.weebly.com/uploads/1/3/0/3/130312996/1278309.pdf In PDF document text
    • http://vumazizozo.coldmineral-soap.com/uploads/2020/01/27/zuvitekaka-nipuratodo-pobed.pdfIn PDF document text
    • http://zuwovidune.filelinux.com/uploads/2020/01/27/7908846.pdfIn PDF document text
    • https://bidivagulopox.weebly.com/uploads/1/3/0/5/130552016/dobakeja.pdfIn PDF document text
    • https://moxinatuzar.weebly.com/uploads/1/3/0/2/130272319/megafebo.pdfIn PDF document text
    • https://fazufabuparofer.weebly.com/uploads/1/3/0/5/130540928/a97a0013bf4b.pdfIn PDF document text
    • http://globaltoursjourneys.com/uploads/2020/01/29/ed1ebeda4.pdfIn PDF document text
    • http://crtropicallivethedream.com/uploads/1/3/0/2/130270832/divabek-dulusilu-muvesizo.pdfIn PDF document text
    • http://xutodi.mukhitdinov.org/uploads/2020/01/28/16f510c185.pdfIn PDF document text
    • http://406cavapoos.com/uploads/1/3/0/5/130545882/baxudet.pdfIn PDF document text
    • http://willspointbluebird.org/uploads/1/3/0/6/130621345/fawiz.pdfIn PDF document text
    • http://100womenwhocarensc.com/uploads/1/3/0/6/130621290/vowatozed-dosozebegu-kobewevik-kaximuvozelomik.pdfIn PDF document text
    • http://triadstartup.com/uploads/1/3/0/6/130639514/sujixibubulezoxo.pdfIn PDF document text
    • http://novo-parfum.ru/uploads/2020/01/28/59e06a6848f.pdfIn PDF document text
    • http://thatanimalgroup.org/uploads/1/3/0/2/130287920/xugerujena.pdfIn PDF document text
    • http://mew3mew.studio/uploads/1/3/0/6/130639928/mukuvipidojitijomi.pdfIn PDF document text
    • http://wawejolun.mydevice-apple.com/uploads/2020/01/28/detemofewibuli_kewigetigulob.pdfIn PDF document text
    • http://theartofshade.de/uploads/1/3/0/5/130543575/361164.pdfIn PDF document text
    • http://morganwaisner.com/uploads/1/3/0/2/130289765/94e83001.pdfIn PDF document text
    • https://tovalopomep.weebly.com/uploads/1/3/0/6/130605258/zekojezamuzan.pdfIn PDF document text
    • http://momentsbyval.com/uploads/1/3/0/2/130289279/3381718.pdfIn PDF document text
    • http://scottrosenthalphoto.com/uploads/1/3/0/4/130435956/130435956.html#android+studio+gradle+project+sync+failedIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000168e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x168E 8212 bytes
SHA-256: 92784b7a61f931b5aaa1b621caa8fa1a89d96c5b120d7c6c236cb756c4bcd618
font_01_sfnt_off00006dc7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6DC7 16352 bytes
SHA-256: e4fc9d559f4a96377a8baf11d056b0c421df137d1df98bf5a0edfb5d4b0c863d

Open this report in the interactive analyzer, or submit your own file for analysis.