Malicious PDF — malware analysis report

Static analysis result for SHA-256 54af9e7cf11fd27a…

MALICIOUS

PDF

40.3 KB Authoring application: Mobipocket Creator First seen: 2020-09-24
MD5: 9351f057424207514076d3b8e680a85a SHA-1: e0f5cdd741abfcd17382e2cfae5d7d899c805103 SHA-256: 54af9e7cf11fd27ad07b494fa3e9f289c0cfbae8ca74220fc5dce69840b3d4a2
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to external PDF files. This suggests a tactic to manipulate search engine results or to distribute further malicious content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent, likely related to phishing or traffic redirection.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://khmajyanalwaldik.com/uploads/1/3/0/6/130604150/xalafozi_zazemokuko_biwamipalekel.pdf In PDF document text
    • http://roilights.com/uploads/1/3/0/3/130379123/kivafojasatigaz-zedokogakadi-vofowe-samukap.pdfIn PDF document text
    • http://missoulaimports.com/uploads/1/3/0/3/130313632/mesetivesikax-lipejamubuxamal-zolitoxoti.pdfIn PDF document text
    • http://serenityrowe.com/uploads/1/3/0/6/130620279/nolelikebewovos-fomasipagasa-mejarokas-dadiminox.pdfIn PDF document text
    • http://webmail.iinsitu.com/uploads/1/3/0/2/130272906/130001.pdfIn PDF document text
    • http://balihaidreams.com/uploads/1/3/0/4/130478609/nexuvelafo_basunopimefote_bofoki_pexevale.pdfIn PDF document text
    • http://like-pi.net/uploads/1/3/0/5/130589452/dowurimom.pdfIn PDF document text
    • http://nrvikingspiritwear.com/uploads/1/3/0/4/130476541/f209c9d8e82f600.pdfIn PDF document text
    • http://multiiverse.com/uploads/1/3/0/5/130550832/1108178.pdfIn PDF document text
    • http://rollatropicalsno.com/uploads/1/3/0/7/130775560/topagugajos.pdfIn PDF document text
    • http://mx.montmarin.org/uploads/1/3/0/8/130873824/pavavanuwa-tisalajuvuliri.pdfIn PDF document text
    • http://modvintiqueinteriors.com/uploads/1/3/0/7/130738841/kavumasogesojev-nixali-vuduwujimo.pdfIn PDF document text
    • http://valcom.tv/uploads/1/3/0/2/130289310/kusejakotela-febukorel.pdfIn PDF document text
    • http://singleparentcounsel.com/uploads/1/3/0/7/130739073/9275e7a6.pdfIn PDF document text
    • http://www.pikalevi.net/uploads/1/3/0/9/130969679/lovekezalepakov.pdfIn PDF document text
    • http://tulipsandroses.photography/uploads/1/3/0/2/130272232/lodejipukek_wazibuzifotoda.pdfIn PDF document text
    • http://newportplant.com/uploads/1/3/0/5/130589431/lipiw_libago_kumipewe.pdfIn PDF document text
    • http://artofitness.com/uploads/1/3/0/2/130289692/nefupowekonod.pdfIn PDF document text
    • http://genmakers.com/uploads/1/3/0/2/130291585/zejawonasokadef.pdfIn PDF document text
    • http://independentadultcarehomeassociation.com/uploads/1/3/0/5/130543353/5464244.pdfIn PDF document text
    • http://minestarters.net/uploads/1/3/0/7/130738950/9495565.pdfIn PDF document text
    • http://birdislandplacenciabz.com/uploads/1/3/0/5/130590503/7723447.pdfIn PDF document text
    • http://blinebeachbar.com/uploads/1/3/0/4/130490602/jixirobokot.pdfIn PDF document text
    • http://tipsytacocantina.com/uploads/1/3/0/3/130379363/2104350.pdfIn PDF document text
    • http://befreetherapy.com/uploads/1/3/0/7/130740492/130740492.html#writing+task+1+criteria+ieltsIn PDF document text
🗂 Part of campaign: wedoopovertyreduction.com 7 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000038d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x38D7 8216 bytes
SHA-256: aa937e27fd7dad455a14235669fecf9d81130e1191208b33bc20502a5c1fe318

Open this report in the interactive analyzer, or submit your own file for analysis.