Malicious PDF — malware analysis report

Static analysis result for SHA-256 48242df3728f1142…

MALICIOUS

PDF

34.8 KB Authoring application: Poppler-utils First seen: 2020-09-24
MD5: d0566712609947bf3bf3f364cb2300aa SHA-1: f9424cc0c3360dd1d924433325b3ed9aae378a61 SHA-256: 48242df3728f1142676367a9d1b2f6fc50b17cd2bf870da534e24f09035713fa
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded URLs disguised as a resource for learning English words. The heuristic 'PDF_SEO_LINK_FARM' indicates these URLs lead to 31 other PDF files, suggesting a link farm designed to distribute malicious content. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious nature of this file, likely acting as a lure for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tiffanyhairsalon.com/uploads/1/3/0/5/130545985/jasoxifurodaf-belawepuju-padedijuvuve.pdf In PDF document text
    • http://ladiffproprete.net/uploads/1/3/0/7/130739087/mifolavenitawenekel.pdfIn PDF document text
    • http://tattletalesboutique.com/uploads/1/3/0/7/130739986/takevajobizizu_sudenukimiwareg_mazupazodatuzi_gonobotibexa.pdfIn PDF document text
    • http://mountaincreeklodging.com/uploads/1/3/0/6/130639701/mefijotumo-fofipore-mejikonurezo-derumuvum.pdfIn PDF document text
    • http://berrypicn.com/uploads/1/3/0/8/130873908/fefepejuremen-jalimevolizozu-xokuzazubis-makabafofozedin.pdfIn PDF document text
    • http://www.thecaregiveroffice.com/uploads/1/3/0/7/130738725/6443755.pdfIn PDF document text
    • http://abraxasband.net/uploads/1/3/0/4/130488316/zilapubijoza.pdfIn PDF document text
    • http://saltlakecitybarbershop.com/uploads/1/3/0/6/130604955/zijupemovo_vuwesederubiw_womejowi.pdfIn PDF document text
    • http://hipposterical.com/uploads/1/3/0/3/130313006/b113b073720d.pdfIn PDF document text
    • http://mta-sts.mx.jessicaraeanderson.com/uploads/1/3/0/7/130740357/kokimufenow_kafusexojavide.pdfIn PDF document text
    • http://beyourselfie.net/uploads/1/3/0/4/130436226/8685583.pdfIn PDF document text
    • http://r-transit.com/uploads/1/3/0/7/130740166/de306bef.pdfIn PDF document text
    • http://project-otaku.com/uploads/1/3/0/6/130639448/rukajuwibiruw.pdfIn PDF document text
    • http://toponsitewellness.com/uploads/1/3/0/6/130621483/beb68e95e0f32b.pdfIn PDF document text
    • http://drgnzombiestournament.com/uploads/1/3/0/6/130603925/zuwederowovuro-fazetofuwogajiw-givip.pdfIn PDF document text
    • http://mylonglocks.com/uploads/1/3/0/7/130775640/3854473.pdfIn PDF document text
    • http://tw-tech.net/uploads/1/3/0/6/130604933/7e61982df.pdfIn PDF document text
    • http://wecheck.online/uploads/1/3/0/4/130490314/dafukow-jopusilurafogu-zobosakuzefisi-fofilol.pdfIn PDF document text
    • http://clickingcanvases.com/uploads/1/3/0/5/130545827/baxireku.pdfIn PDF document text
    • http://leoinspired.com/uploads/1/3/0/6/130604158/7525152.pdfIn PDF document text
    • http://immediateinsight.net/uploads/1/3/0/7/130739713/5904800.pdfIn PDF document text
    • http://myforexleague.com/uploads/1/3/0/2/130288559/e6a09a3bcca9.pdfIn PDF document text
    • http://capellandegetsemani2018.devsite-1.com/uploads/1/3/0/6/130605108/130605108.html#5000+english+words+with+urdu+meaning+pdfIn PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000283d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x283D 6972 bytes
SHA-256: 7ff4d25739950ebd1ba6147393538b32b027881271729798287a799db071c0f8

Open this report in the interactive analyzer, or submit your own file for analysis.