Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c12be3b9b7866fb…

MALICIOUS

PDF

103.1 KB Authoring application: Smallpdf Desktop First seen: 2020-09-07
MD5: 39c8d232378dbd4918f015ef421ec581 SHA-1: 98f48bff161e9e8247770148047812e092ea4010 SHA-256: 4c12be3b9b7866fbe88335af5103f59b34765b058a3b7d082fc654a34bc906a2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, a technique often used for SEO manipulation or to redirect users to malicious content. ClamAV identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection purpose. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted, but the extensive link farm suggests a delivery mechanism for further malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9953

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bbp-phnx1.intra.bradleybeachpd.com/uploads/1/3/0/2/130289424/cddee422c3c16b.pdf In PDF document text
    • http://hostmaster.rgadesignquilts.com/uploads/1/3/0/6/130620845/kamifolaxonobobipun.pdfIn PDF document text
    • http://bimpliciti.net/uploads/1/3/0/5/130543667/2267885.pdfIn PDF document text
    • http://northhobby.us/uploads/1/3/0/6/130603997/wogikomilik-lokepunaremar-rekopixugere.pdfIn PDF document text
    • http://diamondviewfarms.com/uploads/1/3/0/4/130483862/3867473.pdfIn PDF document text
    • http://treemendousnursery.com/uploads/1/3/0/7/130775111/nonitimazemija-xegof-bopet.pdfIn PDF document text
    • http://dadevilleband.com/uploads/1/3/0/5/130590577/cf44141.pdfIn PDF document text
    • http://minhavidaminhasescolhas.com/uploads/1/3/0/2/130270863/xofigutu_wusex_jeruxamojiroj.pdfIn PDF document text
    • http://ddsdestinations.net/uploads/1/3/0/7/130775853/gezurekakiwu-bomasonimu.pdfIn PDF document text
    • http://jwlabs.dev/uploads/1/3/0/2/130287401/xiron.pdfIn PDF document text
    • http://www.browngirlfearless.com/uploads/1/3/0/5/130588843/robijesukuse_jovoja_lezofimisinu_vekorerajo.pdfIn PDF document text
    • http://sijitech.com/uploads/1/3/0/5/130539652/c51184720a407d.pdfIn PDF document text
    • http://hiyeller.com/uploads/1/3/0/7/130776075/018a8327f251221.pdfIn PDF document text
    • http://74-123-77-162.mgwnet.com/uploads/1/3/0/4/130436171/rikedumav-foxemagan-dapabawopil-paxobizixe.pdfIn PDF document text
    • http://affordableinsurancedirect.com/uploads/1/3/0/4/130488415/wakinazugin.pdfIn PDF document text
    • http://carrieandandrew.com/uploads/1/3/0/4/130494059/juburoxidibukez.pdfIn PDF document text
    • http://www.business-fedex.com/uploads/1/3/0/8/130874470/jenibanex_nunuvisogatujil_jadexov_serefo.pdfIn PDF document text
    • http://shit-facedshakespeare.com/uploads/1/3/0/5/130550768/229b38ccce632.pdfIn PDF document text
    • http://lifetunesonline.net/uploads/1/3/0/5/130589228/lejulolafefudi.pdfIn PDF document text
    • http://www.die-hexen-haus.com/uploads/1/3/0/8/130814706/jowatupudedikegi.pdfIn PDF document text
    • http://mta-sts.littleindiarestaurant.ca/uploads/1/3/0/3/130323186/dejenol.pdfIn PDF document text
    • http://mx.alare.net/uploads/1/3/0/7/130775431/8069922.pdfIn PDF document text
    • http://taxauctiontitle.com/uploads/1/3/0/6/130620551/1775951.pdfIn PDF document text
    • http://huangguanzuqiukaihuwang.br3h.com/uploads/1/3/0/7/130740112/130740112.html#kula+kundalini+shakti+jagranIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000f666.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF666 1388 bytes
SHA-256: 1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0
font_01_sfnt_off0000ffcf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFFCF 6464 bytes
SHA-256: 9ad3ddc18670591ede612048015cb5ac4f539323284233c0d1957819b1a9fb8b
font_02_sfnt_off00011ace.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11ACE 20796 bytes
SHA-256: 9121470d1a59b5408e38f359c80ce20d941b1430dcd6014d84793e282e6a40b0

Open this report in the interactive analyzer, or submit your own file for analysis.