Malicious PDF — malware analysis report

Static analysis result for SHA-256 4dd03a2446e9f86e…

MALICIOUS

PDF

35.3 KB Authoring application: pstoedit First seen: 2020-09-24
MD5: 5602cefe8d1a8d41783b5ab06c41b82b SHA-1: 642f48fa7c4dc14b27504c84ab00ec9ccdfc83ba SHA-256: 4dd03a2446e9f86ec663ce1942dce4a9851e464e0f79488b173eae914d3a0311
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files across numerous domains. This behavior is indicative of a link farm or a phishing campaign designed to drive traffic to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.selflovesmeraldamartes.com/uploads/1/3/0/7/130740480/xiwunidafiz_lekiwu_pesopilokimalug_xadik.pdf In PDF document text
    • http://amazdphotography.com/uploads/1/3/0/2/130272353/diburog_pavizoz_diwofotos.pdfIn PDF document text
    • http://vanentrepot.com/uploads/1/3/0/5/130542964/pogasexefu.pdfIn PDF document text
    • http://www.frogdogboutique.com/uploads/1/3/0/3/130324248/megax.pdfIn PDF document text
    • http://partuschfire.org/uploads/1/3/0/7/130776682/bodukafed.pdfIn PDF document text
    • http://ivanprocheret.com/uploads/1/3/0/6/130605017/2357169.pdfIn PDF document text
    • http://guemeschannelembroidery.com/uploads/1/3/0/2/130270924/silinivule_nenumelegem_jifinib.pdfIn PDF document text
    • http://pinehill-in-the-catskills.com/uploads/1/3/0/6/130604315/kikabasixiz.pdfIn PDF document text
    • http://mta-sts.alaskanativeheritagemonth.com/uploads/1/3/0/5/130590538/1488508.pdfIn PDF document text
    • http://globalmacroinvestments.com/uploads/1/3/0/4/130489102/vovava.pdfIn PDF document text
    • http://surnamesonline.com/uploads/1/3/0/3/130312969/fugusix-nifijubur-sorefudasavug.pdfIn PDF document text
    • http://frnkjmz.com/uploads/1/3/0/6/130639641/livomozapip.pdfIn PDF document text
    • http://bsca2016.bsca.info/uploads/1/3/0/4/130488969/c3747b63890efba.pdfIn PDF document text
    • http://texassaddlefitter.com/uploads/1/3/0/8/130815303/7762206.pdfIn PDF document text
    • http://caregivercoffee.com/uploads/1/3/0/6/130621979/535584.pdfIn PDF document text
    • http://bigdsuperfoods.com/uploads/1/3/0/2/130289732/130289732.html#effects+of+poverty+on+learners+pdfIn PDF document text
🗂 Part of campaign: mangumcourtyards.com 11 samples

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d73.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D73 8272 bytes
SHA-256: 7e599d8b2645bbe9c2280846bd1c168f7512d43c14f0eed6a12a9e9e5b769bc8

Open this report in the interactive analyzer, or submit your own file for analysis.