Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a47a45d852f9e2b…

MALICIOUS

PDF

36.9 KB Authoring application: Smallpdf Desktop First seen: 2020-09-15
MD5: 0894dbab64622046a6634e6ee49d88f7 SHA-1: b067b6a3e072f85bc7ee07f4ada88c034adff5eb SHA-256: 5a47a45d852f9e2b8f756d44fc054f9df52d80151350cf16497e273c4139eb0e
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a lure related to a "due date tracker excel template" and embeds a significant number of external links, many pointing to Weebly-hosted PDFs. This behavior, combined with the 'PDF_SEO_LINK_FARM' and 'SE_INVOICE_LURE' heuristics, strongly suggests a phishing or malware distribution campaign. The embedded URLs are likely used to redirect users to malicious content or further stages of an attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://raromofax.weebly.com/uploads/1/3/0/2/130271240/1622842.pdf In PDF document text
    • http://maaloufbrothers.com/uploads/1/3/0/5/130550817/wabapule-lusuturuvage-jonufi-vudapojo.pdfIn PDF document text
    • http://coderedpicturecompany.com/uploads/1/3/0/6/130639895/6319861.pdfIn PDF document text
    • https://muxubobug.weebly.com/uploads/1/3/0/2/130270832/834afefe05e30a.pdfIn PDF document text
    • http://upcomingeventsccpl.weebly.com/uploads/1/3/0/5/130590436/fe52cea8711b.pdfIn PDF document text
    • http://gof.shoprixo.com/uploads/2020/01/27/78113228a1fffe.pdfIn PDF document text
    • http://dreamcatcherlifecoach.com/uploads/1/3/0/5/130539128/4001903.pdfIn PDF document text
    • http://premierbv.com/uploads/1/3/0/3/130379740/eade9094.pdfIn PDF document text
    • http://redriverministries.org/uploads/1/3/0/6/130621284/patitugilixavukibu.pdfIn PDF document text
    • http://pressurecleanperth.com/uploads/1/3/0/4/130436402/kudamowafafow_setesobabivozas_maxopegemexev.pdfIn PDF document text
    • http://595corporateparkofcommerce.com/uploads/1/3/0/5/130550968/xumobemaparug.pdfIn PDF document text
    • http://tbarandelahairstudio.com/uploads/1/3/0/4/130476135/viviwusejefo-fixitaner.pdfIn PDF document text
    • https://wugamivuv.weebly.com/uploads/1/3/0/4/130476104/6339008.pdfIn PDF document text
    • http://organicolosangeles.com/uploads/1/3/0/5/130550818/kimarisi-kenaxabegepa-bemebereteno-tujufod.pdfIn PDF document text
    • http://villa-r.ru:80/uploads/2020/01/29/movemutugeri.pdfIn PDF document text
    • https://wujifonetipipef.weebly.com/uploads/1/3/0/2/130270864/rebutotupi.pdfIn PDF document text
    • http://aearthsport.com/uploads/1/3/0/6/130620459/143a9246efd6208.pdfIn PDF document text
    • http://subhasishchakraborty.weebly.com/uploads/1/3/0/5/130588650/wazexibaxe.pdfIn PDF document text
    • http://numbernineaesthetics.com/uploads/1/3/0/2/130289746/8ebefb0a6f6e4.pdfIn PDF document text
    • http://mimiwong.net/uploads/1/3/0/4/130489055/1413ce45f701ff.pdfIn PDF document text
    • http://funaj.darkempires.ca/uploads/2020/01/28/guwasesopot_xifekeregel_wupajoxog_nevusega.pdfIn PDF document text
    • http://netto-tc.ru/uploads/2020/01/28/8191615.pdfIn PDF document text
    • http://topumu.vipiski-online4.icu/uploads/2020/01/28/taxapezalobikop.pdfIn PDF document text
    • http://labe.lowstory.ru/uploads/2020/01/29/voposemixuti-dogitonidutowe-ninorudazosi.pdfIn PDF document text
    • http://oaptesting.weebly.com/uploads/1/3/0/3/130313649/130313649.html#due+date+tracker+excel+templateIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017e9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17E9 8188 bytes
SHA-256: c3ad62b7e77917801f2fcb3e8ed7452a52d3890e93ce4403a525abc5ce1be233

Open this report in the interactive analyzer, or submit your own file for analysis.