Malicious PDF — malware analysis report

Static analysis result for SHA-256 4f172b13eab29f54…

MALICIOUS

PDF

71.1 KB Authoring application: Mobipocket Creator First seen: 2020-09-07
MD5: 32a96095eb7233c3c0bb2a3bfb18a3a5 SHA-1: 5ec9a4b794acb6ca6b6f2e1d4f281963d896540b SHA-256: 4f172b13eab29f54f2f76536407388d7fa627208619e8d024b993d6664ed883a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The PDF contains a link farm pointing to numerous external PDF files, suggesting a SEO spam or redirection tactic. The document body, despite being truncated and containing obfuscated content, mentions 'Korean alphabet pronunciation rules' and embeds URLs, reinforcing the idea of a lure to external content. The primary attack pattern appears to be SEO spam or a phishing pretext to drive traffic to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9946

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://carpetcleaning-phoenix.com/uploads/1/3/0/4/130435654/15a63842c.pdf In PDF document text
    • http://mrhowe.org/uploads/1/3/0/2/130288565/f99c7777.pdfIn PDF document text
    • http://eurekaarchitecture.com/uploads/1/3/0/7/130738852/naxud.pdfIn PDF document text
    • http://braveangelyoga.com/uploads/1/3/0/5/130588168/2371539.pdfIn PDF document text
    • http://michaelshusko.com/uploads/1/3/0/8/130873944/130873944.html#korean+alphabet+pronunciation+rulesIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001086.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1086 9236 bytes
SHA-256: 2be04d6f984b7765d94a60b6337e3b91a7df273c1683335b271d0c0586a7f4d4
font_01_sfnt_off000084f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x84F6 17620 bytes
SHA-256: b94df823ea9ed9ab6d6af83c82b1f00060be3fdba22f1409cf9b9956075801de
font_02_sfnt_off00009ea4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9EA4 6728 bytes
SHA-256: 5278024270de67705d3a5034a26ce2f5e1d9e53f50705cc770b2190155f81e7b
font_03_sfnt_off0000b22b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xB22B 18428 bytes
SHA-256: 44c23b12b2368e851c4f1276c58dc2c4742e1e224367c6586b0162f9ec256e55

Open this report in the interactive analyzer, or submit your own file for analysis.