Malicious PDF — malware analysis report

Static analysis result for SHA-256 462eeea12015a171…

MALICIOUS

PDF

36.7 KB Authoring application: PDF Studio First seen: 2020-09-24
MD5: 2ad237af6e42a967428713913f395490 SHA-1: 7f01a4fbc3313a0c7fd1438763385ec88aab0c64 SHA-256: 462eeea12015a171b441e168d86cda409ef6c63b5cc4fe3ba6972f01f4dafeee
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified as a link farm, and is flagged as a classic advance-fee fraud document. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports its malicious nature. The embedded URLs likely lead to further phishing content or malware downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bourbonhome.com/uploads/1/3/0/3/130324075/somofa-vavenakuzasadi.pdf In PDF document text
    • http://northwestpetsupplies.com/uploads/1/3/0/5/130588856/44cbe439d.pdfIn PDF document text
    • http://theinnonsilverlake.com/uploads/1/3/0/5/130551057/mewewan.pdfIn PDF document text
    • http://thepuppysocial.com/uploads/1/3/0/4/130483856/vunab.pdfIn PDF document text
    • http://www.thisweeksbestdeals.co.uk/uploads/1/3/0/5/130590154/jasevufir.pdfIn PDF document text
    • http://thankorchange.org/uploads/1/3/0/5/130588164/resepodosebaxukijij.pdfIn PDF document text
    • http://sunnysidekids.com/uploads/1/3/0/7/130739664/790946.pdfIn PDF document text
    • http://mrsjdodds.com/uploads/1/3/0/6/130639298/ropufesakinunotuf.pdfIn PDF document text
    • http://jkjlawnsprinkler.com/uploads/1/3/0/2/130270849/3742886.pdfIn PDF document text
    • http://kamilasbeautyroom.com/uploads/1/3/0/7/130738997/2406987.pdfIn PDF document text
    • http://matthewgordonphotos.net/uploads/1/3/0/6/130620366/pivafusibuket.pdfIn PDF document text
    • http://www.jubileeandthestinkyfish.com/uploads/1/3/0/5/130590310/7299726.pdfIn PDF document text
    • http://urbannations.info/uploads/1/3/0/4/130475994/0a7af1dc80e93d.pdfIn PDF document text
    • http://upstatephotography.org/uploads/1/3/0/6/130604288/5839474.pdfIn PDF document text
    • http://solvemytechproblem.com/uploads/1/3/0/6/130639397/bibulozixotijij.pdfIn PDF document text
    • http://megadethslot.com/uploads/1/3/0/3/130379299/paperobovunojaz-potutemefuzitiw-tafogazak.pdfIn PDF document text
    • http://washingtondealerships.com/uploads/1/3/0/5/130539554/tapaluvelodid_zobufezi_kolilirarujimul.pdfIn PDF document text
    • http://x0169003xstreamtravel.xsideas.com/uploads/1/3/0/7/130776449/130776449.html#algorithms+%284th+edition%29+by+robert+sedgewick+pdfIn PDF document text
🗂 Part of campaign: deadeyestudios.co 9 samples

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000328e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x328E 7912 bytes
SHA-256: 85bd83f9aceffd6ad45825383845a949188986fba60cee8faacda646420d563b

Open this report in the interactive analyzer, or submit your own file for analysis.