Malicious PDF — malware analysis report

Static analysis result for SHA-256 4ea37eba7defdf5f…

MALICIOUS

PDF

58.3 KB Authoring application: Adobe PDF Library 9.0 First seen: 2020-09-04
MD5: 1563dd2a6a7520a3990cac5e0d444105 SHA-1: c3d850a87eb08e7d200fd57c642cbbc9e190605e SHA-256: 4ea37eba7defdf5f9a614ceed749fee31086d36848994852b06806432394d7eb
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files, indicating a link farm or a distribution mechanism for further content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the critical heuristic 'PDF_SEO_LINK_FARM' strongly suggest malicious intent, likely related to phishing or traffic redirection. No scripts were extracted, but the structure and embedded URLs are sufficient to infer the attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theprojectiondesk.com/uploads/1/3/0/6/130621831/3823020.pdf In PDF document text
    • http://love-your-mind.com/uploads/1/3/0/3/130379757/989128.pdfIn PDF document text
    • https://genusemis.weebly.com/uploads/1/3/0/5/130551279/bijima.pdfIn PDF document text
    • http://kubafo.servago.ru/uploads/2020/01/28/bodatubejipav-sirezojuxoxa-solopadupux.pdfIn PDF document text
    • http://kosherscd.com/uploads/1/3/0/5/130540366/ce7d5dcc4516e.pdfIn PDF document text
    • http://remudojad.buyfiesta.ru/uploads/2020/01/28/nojemonunexojok_punewevo_kilixafelal_mobomivivubewet.pdfIn PDF document text
    • http://juvimujuka.galaxycom.ru/uploads/2020/01/28/6949070.pdfIn PDF document text
    • http://turizmtlt.ru/uploads/2020/01/27/zasunijulumewu-zavas.pdfIn PDF document text
    • http://sag.kelta.ru/uploads/2020/01/29/553884.pdfIn PDF document text
    • https://nuguruti.weebly.com/uploads/1/3/0/4/130488812/bobawebafe.pdfIn PDF document text
    • http://carenciayoga.com/uploads/1/3/0/6/130604894/9ede367f846.pdfIn PDF document text
    • http://torreazul.es/uploads/1/3/0/2/130289154/5338676.pdfIn PDF document text
    • http://teb.infonetacademy.tech/uploads/2020/01/28/valujobanopoga.pdfIn PDF document text
    • http://bujodekeke.nissancentr.com/uploads/2020/01/29/vanixo-negupudepugexaw.pdfIn PDF document text
    • http://giritaravi.catiacristais.com/uploads/2020/01/27/woxumejetolorafakire.pdfIn PDF document text
    • http://stephenm.ca/uploads/1/3/0/6/130605405/580d25.pdfIn PDF document text
    • http://2020sugarland.net/uploads/1/3/0/6/130604348/b3a80c7540b4.pdfIn PDF document text
    • http://zisexijofa.sportyers.com/uploads/2020/01/28/ratuwisus.pdfIn PDF document text
    • http://lakelifefashions.com/uploads/1/3/0/4/130488483/4807327.pdfIn PDF document text
    • http://cshennessyenterprises.net/uploads/1/3/0/6/130621021/pemamisozud-tunekewavavax-bosugi-nixatilum.pdfIn PDF document text
    • http://oceanviewlotuvita.com/uploads/1/3/0/4/130483684/1608495.pdfIn PDF document text
    • http://animaleyeconsultantsd.com/uploads/1/3/0/6/130620681/130620681.html#chinese+bopomofo+keyboardIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000182d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x182D 8456 bytes
SHA-256: e1fd935585d139d99fbdf9ac34b99770c6d3012d0b7f3a70f0a6cd64b9a539fb
font_01_sfnt_off00007518.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7518 16100 bytes
SHA-256: b46a2962b81877f921f80e7256dd844f05ce4df28b49cba209514fa1e1f6605d
font_02_sfnt_off0000897c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x897C 2652 bytes
SHA-256: e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea
font_03_sfnt_off000092ff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x92FF 9888 bytes
SHA-256: fb1fc0b5832b63896e67e59bd987f4e08fe379beef375386958a2df622cb68d5

Open this report in the interactive analyzer, or submit your own file for analysis.