Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a266766a6f6e390…

MALICIOUS

PDF

41.5 KB Authoring application: pstoedit First seen: 2020-09-24
MD5: 89c96c5c3015c5a03d3c77340e7965b2 SHA-1: 6806df044263d71ecb2658581dd687b164fa6f2f SHA-256: 5a266766a6f6e39064c0957ccca7be75ca5e7d00e7e67d607ab5f4cbc63a9bab
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.001 User Execution: Malicious Link T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This technique is commonly used for phishing campaigns or to distribute further malware. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and malicious redirection intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://parkplacedepot.com/uploads/1/3/0/3/130313082/bipetamabatuf-tafegozitubape-potozivug.pdf In PDF document text
    • http://mta114.qualitynow.net/uploads/1/3/0/4/130489418/1290649.pdfIn PDF document text
    • http://envyious.com/uploads/1/3/0/5/130588480/jujexema.pdfIn PDF document text
    • http://www.elliebustamante.com/uploads/1/3/0/6/130604505/eaad3daaa1c71d.pdfIn PDF document text
    • http://canepaahclp.com/uploads/1/3/0/3/130323892/6398598.pdfIn PDF document text
    • http://mosholudaycamp.com/uploads/1/3/0/3/130313320/renusa_bojutoxefoka.pdfIn PDF document text
    • http://swearingenfamily.com/uploads/1/3/0/5/130588232/c0445fe83.pdfIn PDF document text
    • http://bikeguyslc.com/uploads/1/3/0/5/130588442/8570228.pdfIn PDF document text
    • http://thestarlightclub.com/uploads/1/3/0/6/130621901/60409bd434a6e.pdfIn PDF document text
    • http://brytnsduds4donors.org/uploads/1/3/0/6/130603824/gapexerenenadewataji.pdfIn PDF document text
    • http://jfainnovative.com/uploads/1/3/0/6/130604492/5500086.pdfIn PDF document text
    • http://www.drkatieskitchen.com/uploads/1/3/0/4/130483350/guxuzusisoru_dutos_meloxusexa_fuzev.pdfIn PDF document text
    • http://mail.xenastrategies.com/uploads/1/3/0/7/130738705/memaku_daxexifipo_kularuposekokod.pdfIn PDF document text
    • http://baronyofthelonelytower.org/uploads/1/3/0/6/130621277/6c0041442.pdfIn PDF document text
    • http://hostmaster.townsendcars.co.uk/uploads/1/3/0/5/130551303/d61de51540ea.pdfIn PDF document text
    • http://neilgeyette.com/uploads/1/3/0/7/130738711/zenovijer.pdfIn PDF document text
    • http://scahistoricalsociety.com/uploads/1/3/0/6/130639098/zuzakomidodunedipivo.pdfIn PDF document text
    • http://almacca.com/uploads/1/3/0/2/130289392/0fa02.pdfIn PDF document text
    • http://creatingtheconditionsfortransformation.com/uploads/1/3/0/4/130475980/1022245.pdfIn PDF document text
    • http://www.surgicoordinator.net/uploads/1/3/0/4/130435622/35aa03fa760596e.pdfIn PDF document text
    • http://www.shiying-cheng.com/uploads/1/3/0/2/130272586/c8e58.pdfIn PDF document text
    • http://eycongrats.com/uploads/1/3/0/5/130551864/5798740.pdfIn PDF document text
    • http://kyidealroofing.com/uploads/1/3/0/6/130604996/5552195.pdfIn PDF document text
    • http://mymountainstories.com/uploads/1/3/0/7/130740110/kepuna.pdfIn PDF document text
    • http://74-123-77-77.mgwnet.com/uploads/1/3/0/6/130639690/130639690.html#characteristic+ir+absorption+of+functional+groupsIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003186.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3186 2600 bytes
SHA-256: 57d6e63e99d889981e260268493a79c6cd61aee50b56242e624f4c4d43ebda92
font_01_sfnt_off00003d47.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3D47 8324 bytes
SHA-256: 7a9f9b5c7931a600accd43f82ccd1e42d4ba6beedcd6967b4d2bbe0699f9b3ef

Open this report in the interactive analyzer, or submit your own file for analysis.