Malicious PDF — malware analysis report

Static analysis result for SHA-256 57ff909bcd8c4740…

MALICIOUS

PDF

39.1 KB Authoring application: Soda PDF First seen: 2020-09-24
MD5: c5ef0747262c3c5b77317dddd1f0779b SHA-1: ab73904ec71d914ec8d02ad923d8e96da779a4d1 SHA-256: 57ff909bcd8c47409a593c82f2e480ebb5f795ef3e3c72fbbad18c29be0e032a
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a link farm with multiple external PDF links, indicated by the PDF_SEO_LINK_FARM heuristic. The document body also contains a call-to-action phrase and embedded URLs, suggesting a lure to download further content. The ClamAV detection as Pdf.Dropper.Agent-7729500-0 confirms the malicious nature of the file, likely acting as a dropper for other malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Dropper.Agent-7729500-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7729500-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wofu.service-dnr.ru/uploads/2020/01/27/zamarenoxumajaj_dipufumelovudot.pdf In PDF document text
    • http://xevaxikusa.optomsahar.ru/uploads/2020/01/29/9957343.pdfIn PDF document text
    • https://muzetikoxufam.weebly.com/uploads/1/3/0/4/130476385/50328.pdfIn PDF document text
    • http://davero.artlawyer.ru/uploads/2020/01/28/ff5f6291f6427.pdfIn PDF document text
    • http://vanmarkitonmusic.com/uploads/1/3/0/5/130550754/kijibofi_wosefametelepe_wimozevijo_vivabanov.pdfIn PDF document text
    • https://palevibi.weebly.com/uploads/1/3/0/5/130588487/foboj-jexivi.pdfIn PDF document text
    • http://my-bizco.com/uploads/1/3/0/6/130604531/130604531.html#crash+bandicoot+exe+pcIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001133.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1133 8236 bytes
SHA-256: 71e4a0db7734473d5366ee03e9d958ba5b250ddf5be127a6b45173828e3fe5ff
font_01_sfnt_off0000537c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x537C 6316 bytes
SHA-256: 1f7afb89cead62a2cf29361c11e2cf6c033570b15fcb526ff384863c48fcbd35

Open this report in the interactive analyzer, or submit your own file for analysis.