Malicious PDF — malware analysis report

Static analysis result for SHA-256 52b9ec16a3d5cba5…

MALICIOUS

PDF

43.4 KB Authoring application: PDF Studio First seen: 2020-09-24
MD5: acf85c77edafbf1a3f5f5f7a828ebe34 SHA-1: 0ef4578daf680eee062b6cfe32174cab72c85199 SHA-256: 52b9ec16a3d5cba5d8ab570b4cf759d5d2dc5f43848d2a1cd61675a8fd5d22b7
192 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.002 Spearphishing Attachment

The PDF document contains a link farm of external PDF files, a common technique for SEO poisoning and distributing malicious content. The heuristic 'SE_BROWSER_INSTALL_LURE' indicates the document explicitly prompts the user to install a browser extension or update to view content. This social engineering tactic, combined with the numerous external links, suggests the primary goal is to trick users into downloading further malware or visiting malicious sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://advanceadvocacyandsupport.com/uploads/1/3/0/2/130272847/denumofelumada.pdf In PDF document text
    • http://mich-interiordesignllc.com/uploads/1/3/0/5/130551727/xegedisenawa.pdfIn PDF document text
    • http://napavalleybus.com/uploads/1/3/0/8/130814076/9526606.pdfIn PDF document text
    • http://letsgotospace.com/uploads/1/3/0/6/130621757/7906921.pdfIn PDF document text
    • http://love-in-the-afternoon.com/uploads/1/3/0/3/130323811/zapewoxowazabej_rawinidolari_gopomawifovalu_lopuzigogef.pdfIn PDF document text
    • http://mikewilliamsmusicclasses.com/uploads/1/3/0/4/130477245/c8ca0f6f3544ebf.pdfIn PDF document text
    • http://propertiesbypaula.com/uploads/1/3/0/3/130323616/vodutibavexop_pagubuvasuzatu_pavatejutemupid.pdfIn PDF document text
    • http://bejustalittlebetter.com/uploads/1/3/0/2/130270977/130270977.html#input+type+file+not+working+in+mozillaIn PDF document text
🗂 Part of campaign: mikewilliamsmusicclasses.com 6 samples

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001242.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1242 9244 bytes
SHA-256: 0cf84724a4a6a1c7b2071ffd16f6cdc2d28dd98233549529d17f85e5c626e1db

Open this report in the interactive analyzer, or submit your own file for analysis.