Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ac58c750896e41a…

MALICIOUS

PDF

42.2 KB Authoring application: GIMP First seen: 2020-09-24
MD5: 2a53f06d00189c249aa6d6c87dcc50e1 SHA-1: da880d2a3512954d36e21f7f722cf35d9c7f5bfb SHA-256: 4ac58c750896e41ae9a1dec470099bc6bab756e814977bdf0484c23eb4ea4c1d
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also strongly suggest malicious intent. The primary purpose appears to be directing users to a link farm, likely for SEO abuse or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://farmlawyer.com/uploads/1/3/0/5/130589384/fusewe.pdf In PDF document text
    • http://amongotherrunners.com/uploads/1/3/0/6/130620607/6571639.pdfIn PDF document text
    • http://penguinjournal.online/uploads/1/3/0/6/130621506/bubosu.pdfIn PDF document text
    • http://planthealthcare-mortonarb.org/uploads/1/3/0/6/130621361/botot_wewevi_jumolubotun_roresi.pdfIn PDF document text
    • http://yeomansflowers.com/uploads/1/3/0/7/130738993/mojijeruvejip.pdfIn PDF document text
    • http://fiendfanzine.club/uploads/1/3/0/6/130621031/jijoxope.pdfIn PDF document text
    • http://poko.chat/uploads/1/3/0/2/130289782/buvubinak-zufabatal-modabutemezeva.pdfIn PDF document text
    • http://us41marion.com/uploads/1/3/0/7/130775972/50406584cc5.pdfIn PDF document text
    • http://www.colorobstaclerush.eu/uploads/1/3/0/8/130814669/535566.pdfIn PDF document text
    • http://assric.org/uploads/1/3/0/6/130621502/vitelofodolivi.pdfIn PDF document text
    • http://defiesmeasurement.com/uploads/1/3/0/4/130476272/130219.pdfIn PDF document text
    • http://thebacqroom.com/uploads/1/3/0/7/130775705/2317920.pdfIn PDF document text
    • http://strawhatgames.com/uploads/1/3/0/5/130551457/kapivisiwepa.pdfIn PDF document text
    • http://podollangpis.devsite-1.com/uploads/1/3/0/6/130639656/646186.pdfIn PDF document text
    • http://guiasregionais.com/uploads/1/3/0/7/130739472/282562800ca8.pdfIn PDF document text
    • http://poerecords.net/uploads/1/3/0/2/130271085/fumulok_titadagukek_musilu_firux.pdfIn PDF document text
    • http://futureofwork2018.com.au/uploads/1/3/0/7/130738964/412354d2cf.pdfIn PDF document text
    • http://modibra.com/uploads/1/3/0/2/130273798/wazivegiwelaxa.pdfIn PDF document text
    • http://420fitness.jimmysjava.com/uploads/1/3/0/5/130541384/bugadaguwatumom.pdfIn PDF document text
    • http://www.bethelamechurchluling.com/uploads/1/3/0/6/130605077/zipapulorawigagowe.pdfIn PDF document text
    • http://lcdigitalconnect.com/uploads/1/3/0/2/130271004/kinigil.pdfIn PDF document text
    • http://nursingarmpillow.com/uploads/1/3/0/2/130289595/8319962.pdfIn PDF document text
    • http://pressurewashingtorrance.com/uploads/1/3/0/4/130476089/jawedomexi_dasubagoje_wadofilifulixe_siwiv.pdfIn PDF document text
    • http://northmetrotrustedprofessionals.com/uploads/1/3/0/2/130289411/2321250.pdfIn PDF document text
    • http://sacasta.voyagerwebsites.com/uploads/1/3/0/5/130540214/130540214.html#2.5+cm+grid+paper+printableIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002bc2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2BC2 16036 bytes
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63
font_01_sfnt_off000042a5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x42A5 7468 bytes
SHA-256: caf1c7c0a3659c5271fd05a83b0f73be0a660887a068b95c0097a728d0d0a044

Open this report in the interactive analyzer, or submit your own file for analysis.