Malicious PDF — malware analysis report

Static analysis result for SHA-256 56afc565b8650c1d…

MALICIOUS

PDF

64.8 KB Authoring application: GIMP First seen: 2020-09-24
MD5: 23bd63c2858184ffcb3991fafd58d6fa SHA-1: ca78cff32c0c86498e8f9e88c87e122fd91b6371 SHA-256: 56afc565b8650c1dbd46a146c468d740f714504ac2e465661677e2f6cf4d0c01
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by multiple heuristics, including a critical finding for a large external link farm and a ClamAV detection for phishing malware. The embedded URLs point to numerous PDF files hosted on various domains, suggesting a coordinated effort to distribute malicious content or manipulate search engine results. The document body contains garbled text, indicating it is not intended for human consumption but rather as a container for these links.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://propietarios.sindelantal.mx/uploads/1/3/0/5/130541133/3463502.pdf In PDF document text
    • http://waimeapreservation.net/uploads/1/3/0/5/130589219/nagivebepafukerowobu.pdfIn PDF document text
    • http://doleshalconsulting.com/uploads/1/3/0/6/130604303/9912660.pdfIn PDF document text
    • http://www.10pettee.com/uploads/1/3/0/3/130323596/2546874.pdfIn PDF document text
    • http://aharesidents.com/uploads/1/3/0/5/130550762/wupopokutotar.pdfIn PDF document text
    • http://milfordmagic.com/uploads/1/3/0/2/130287727/4856766.pdfIn PDF document text
    • http://nashbw.info/uploads/1/3/0/5/130539227/8135227.pdfIn PDF document text
    • http://neuropolisblog.com/uploads/1/3/0/5/130588419/80dd227c77f8.pdfIn PDF document text
    • http://romanacoutureshop.com/uploads/1/3/0/7/130739751/moniwalo_netezerotufos_mamifola_rijekisizupu.pdfIn PDF document text
    • http://damathitsar.com/uploads/1/3/0/6/130620356/6854449.pdfIn PDF document text
    • http://mmshop.club/uploads/1/3/0/2/130287279/d15c9c.pdfIn PDF document text
    • http://mta-sts.mail.willbardenwerper.com/uploads/1/3/0/3/130313148/tuvokagire.pdfIn PDF document text
    • http://rodencraterproject.org/uploads/1/3/0/7/130740618/wuref.pdfIn PDF document text
    • http://beingsemprendedores.com/uploads/1/3/0/6/130604595/bugaj.pdfIn PDF document text
    • http://newmexicohighlandmeatprocessing.com/uploads/1/3/0/6/130639027/edb081575467b7f.pdfIn PDF document text
    • http://ministrystudy.org/uploads/1/3/0/3/130323789/95cf773.pdfIn PDF document text
    • http://moretoexplore.co/uploads/1/3/0/8/130813132/6739662.pdfIn PDF document text
    • http://buycommercialplaygrounds.com/uploads/1/3/0/6/130639327/kudosiz-gorigivetok-vupubofoki.pdfIn PDF document text
    • http://cerecdigital.com/uploads/1/3/0/6/130604312/jejezusisezeziwe.pdfIn PDF document text
    • http://www.thelordsays.com/uploads/1/3/0/5/130588640/dijokitalenaxow.pdfIn PDF document text
    • http://mhessential.net/uploads/1/3/0/3/130313641/vewexaga_vivofemam_xomidilenos.pdfIn PDF document text
    • http://blackhatbakery.com/uploads/1/3/0/5/130551222/8442602.pdfIn PDF document text
    • http://host43.carmichaelnl.com/uploads/1/3/0/6/130603782/130603782.html#authoritarian+parenting+style+in+asian+societies+a+cluster-+analytic+investigationIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000173e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x173E 8868 bytes
SHA-256: d773c10479fe62697cb2da47926594b7291b260c229e941992ec57a3722747ce

Open this report in the interactive analyzer, or submit your own file for analysis.