Malicious PDF — malware analysis report

Static analysis result for SHA-256 49eba33cc9f9fb1c…

MALICIOUS

PDF

72.4 KB Authoring application: Mobipocket Creator First seen: 2020-09-24
MD5: d40a486f73ed25a3b74ba5b973fc0ad2 SHA-1: 1a67852b0ec0bae35b5091634afae308af067239 SHA-256: 49eba33cc9f9fb1c72505321576e6eb60ec3cc64332585429ca2c117a5ad18f5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files, indicative of a link farm designed to redirect users to malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, specifically related to phishing or malware distribution. The heuristic PDF_SEO_LINK_FARM firing confirms the presence of a link farm, with the primary domain being nvclosedeals.com. The document body, though heavily obfuscated, contains references to 'Mobipocket Creator' and 'Cervical cancer screening guidelines 2018 ppt', likely serving as a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nvclosedeals.com/uploads/1/3/0/2/130288639/ziweseba.pdf In PDF document text
    • http://wisevifad.preventus.ru/uploads/2020/01/28/botuzu.pdfIn PDF document text
    • http://no-drift.com/uploads/1/3/0/3/130379466/vozewelatok-popamebivuj-dusofudika-rogosepojovete.pdfIn PDF document text
    • http://zeroware.org/uploads/1/3/0/4/130488199/lidexeb-wudodofi.pdfIn PDF document text
    • http://petereliason.net/uploads/1/3/0/6/130604303/fapapezol-devamifu.pdfIn PDF document text
    • http://drscottmarder.com/uploads/1/3/0/5/130588745/zagidodosolelis.pdfIn PDF document text
    • http://runstrong-ie.org/uploads/1/3/0/6/130620272/rekesumevizikozu.pdfIn PDF document text
    • http://lemoulinetcollection.com/uploads/1/3/0/4/130479008/2489019.pdfIn PDF document text
    • http://northernsound.com/uploads/1/3/0/6/130604147/pejesofitog.pdfIn PDF document text
    • http://addisonbeaux.com/uploads/1/3/0/6/130605270/lezatonijawiropi.pdfIn PDF document text
    • http://afaparents.org/uploads/1/3/0/6/130621634/130621634.html#cervical+cancer+screening+guidelines+2018+pptIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000138b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x138B 9232 bytes
SHA-256: 6efd1c1c60151b7d574af1af788480ccaf8777e9665591fdc3eb761edb33ccd3
font_01_sfnt_off0000d6d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD6D9 2732 bytes
SHA-256: da6e935b6a97a045a0c5629c3666d6f53d7c870963c8d55116ca0c7eba84cbf8
font_02_sfnt_off0000e009.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE009 2708 bytes
SHA-256: 825c57cdace7b15f83ae74c7faeb6e5af7ce473af8d1529e82685014e68ee255

Open this report in the interactive analyzer, or submit your own file for analysis.