Malicious PDF — malware analysis report

Static analysis result for SHA-256 586dbf5397a433ec…

MALICIOUS

PDF

59.5 KB Authoring application: Solid Converter PDF First seen: 2020-05-14
MD5: cf7e3947ceb988dd2c37c2bca97fe684 SHA-1: d521c4f46b2ade7b140abb04864d28d6c2fec2ac SHA-256: 586dbf5397a433ecf33e92719003671330704676f3dc6f9b817e55cf93273011
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document was flagged by multiple heuristics, including a critical alert for a link farm containing 31 external PDF URLs. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The embedded URLs likely serve as a distribution mechanism for further malicious content or phishing attempts.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mid-ohiovalleybulk.weebly.com/uploads/1/3/0/4/130488371/labutefitiwim_waguxesatevapij_vibanob.pdf In PDF document text
    • http://krishnaandnatansh.com/uploads/1/3/0/6/130621404/6023978.pdfIn PDF document text
    • http://movedomaintonewaccttest.com/uploads/1/3/0/3/130312980/de02c.pdfIn PDF document text
    • http://freespiritslongisland.com/uploads/1/3/0/5/130539871/9480540.pdfIn PDF document text
    • http://spotlightphotos.net/uploads/1/3/0/2/130289558/sovivabalirekiwi.pdfIn PDF document text
    • http://mysafeheaven.com/uploads/1/3/0/4/130435672/xavujuza-vodiriribaref.pdfIn PDF document text
    • http://mslodersclass.weebly.com/uploads/1/3/0/5/130539759/0c330.pdfIn PDF document text
    • http://suwinojod.gamer-card.com/uploads/2020/01/27/varoderob_xokuvupuwatasi_xuviwal_xenofo.pdfIn PDF document text
    • https://tonevazumijavud.weebly.com/uploads/1/3/0/3/130379864/gatetomelib.pdfIn PDF document text
    • https://daviwamasazoluz.weebly.com/uploads/1/3/0/5/130538981/89075.pdfIn PDF document text
    • http://shopsheldons.com/uploads/1/3/0/3/130379074/3bfc62.pdfIn PDF document text
    • http://14daychallengecom.com/uploads/1/3/0/4/130476162/4639854.pdfIn PDF document text
    • http://carnegieam.org/uploads/1/3/0/2/130289371/9a8e405fae.pdfIn PDF document text
    • http://mytaj-prembenefits.com/uploads/1/3/0/5/130542734/9369405.pdfIn PDF document text
    • http://led-chicago.com/uploads/1/3/0/5/130588424/8098900.pdfIn PDF document text
    • http://collinsmslibrary.org/uploads/1/3/0/4/130488401/visisabozofujen_mutatasag.pdfIn PDF document text
    • http://campbellsdental.com/uploads/1/3/0/2/130288468/7168570.pdfIn PDF document text
    • http://hobipago.com/uploads/1/3/0/6/130620869/e42b0419.pdfIn PDF document text
    • http://centrprava40.ru/uploads/2020/01/27/8018518.pdfIn PDF document text
    • http://consultorianora.com/uploads/1/3/0/6/130604028/noniw.pdfIn PDF document text
    • http://theprocessperfomance.com/uploads/1/3/0/4/130476778/futanadutep_rinana_xaran_dusexewo.pdfIn PDF document text
    • http://bestreviewscbd.com/uploads/1/3/0/4/130478868/nimazamurevo-vilamoridan.pdfIn PDF document text
    • http://nisevip.frmclinicsrussia.ru/uploads/2020/01/28/8140918.pdfIn PDF document text
    • http://cityglush13.icu/uploads/2020/01/27/nijedi.pdfIn PDF document text
    • http://vestmoglobal.com/uploads/1/3/0/5/130590462/gadosuserezaru.pdfIn PDF document text
    • http://applyfordisabilitynow.us/uploads/1/3/0/2/130272603/130272603.html#ost+age+of+youth+butterflyIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text
🗂 Part of campaign: berberthemes.com 3 samples

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001956.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1956 8356 bytes
SHA-256: 5ab70a2301cf526ef3a26017db6cbc9c41cbe00cad988f98d79bf9ac3b3791d6
font_01_sfnt_off00006d10.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6D10 5088 bytes
SHA-256: b80a5c003d70237372709d105215d399a13d85ef9e4e2ecc90c8e37f08db6523
font_02_sfnt_off00007b65.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7B65 17156 bytes
SHA-256: 01cc69c0ff4eb497c4b31324848ebafef62d767031ac7a49e12fb253a856a0e7
font_03_sfnt_off000094ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x94BA 11292 bytes
SHA-256: d692f9c1608ddf187e0d5b0fd96723e278b3b48f862f1abadbc8ef5cb2f3cbaf

Open this report in the interactive analyzer, or submit your own file for analysis.