Malicious PDF — malware analysis report

Static analysis result for SHA-256 51b6a5c8434fada8…

MALICIOUS

PDF

47.1 KB Authoring application: GIMP First seen: 2020-09-07
MD5: 46b6b856c712f419bed9261e515d3824 SHA-1: 2ce978318773c2d40ac7f15e39fbfdc9736b8c50 SHA-256: 51b6a5c8434fada8f084ed5a690a9b2ba1610ab11633713e4030388466558a25
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or malicious redirection intent. The document body is heavily obfuscated and contains many of the same URLs, reinforcing the attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vepaxaf.sendfrs.com/uploads/2020/01/28/6547152.pdf In PDF document text
    • http://speakingthestraighttruth.com/uploads/1/3/0/3/130313405/zuzazagajadu-pozukex-redokiwuz.pdfIn PDF document text
    • http://foboxa.gamesplusadventure.ru/uploads/2020/01/28/kunaporupirutita.pdfIn PDF document text
    • http://mecatta.com/uploads/1/3/0/6/130621603/piwijezo-tatajoj-wifuralalopit-fegaj.pdfIn PDF document text
    • http://holistichealingsd.com/uploads/1/3/0/6/130620428/5042813.pdfIn PDF document text
    • http://jarosewex.storeshop.xyz/uploads/2020/01/28/7547887.pdfIn PDF document text
    • http://royaltrainridesrentals.com/uploads/1/3/0/6/130620474/zuzok.pdfIn PDF document text
    • http://seedlingsystems.co/uploads/1/3/0/6/130604757/4497336.pdfIn PDF document text
    • http://urologya.expert/uploads/2020/01/28/8845217.pdfIn PDF document text
    • http://suvofozato.gatsbydoubler.icu/uploads/2020/01/29/92eaa91949f5a3b.pdfIn PDF document text
    • http://nab.cityglush13.icu/uploads/2020/01/28/1407757.pdfIn PDF document text
    • https://bedegobibise.weebly.com/uploads/1/3/0/4/130483390/bekerekaf.pdfIn PDF document text
    • http://sig.intropack.ru/uploads/2020/01/27/de1d1e6d70ae.pdfIn PDF document text
    • http://star-nrg.com/uploads/1/3/0/5/130551073/2714285.pdfIn PDF document text
    • http://clarksurveyor.com/uploads/1/3/0/6/130603851/599e3ed02a330c4.pdfIn PDF document text
    • http://texegul.archisidek.com/uploads/2020/01/28/ec4aaa23470.pdfIn PDF document text
    • http://cfthomas.com/uploads/1/3/0/6/130639038/130639038.html#dead+zone+zombie+crisisIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001633.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1633 9328 bytes
SHA-256: 30eba54042e16aa620534c6246a6853085830dc284cdf06e254d6b48cf127508
font_01_sfnt_off00006bf8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6BF8 19592 bytes
SHA-256: 3f66fde3d598d448d441281ee2991d3adcdfb6038811367f9bbe67bf786d317c

Open this report in the interactive analyzer, or submit your own file for analysis.