Malicious PDF — malware analysis report

Static analysis result for SHA-256 6361760d6bb36f88…

MALICIOUS

PDF

59.8 KB Authoring application: Poppler-utils First seen: 2020-09-24
MD5: 125c8d14a24ddfad174e7b9181253d12 SHA-1: 585b46a224b4662e56b83d82de24949ccba0f168 SHA-256: 6361760d6bb36f88af5b55735a5ad85f24d14deac7a6f3cc120287ecd0959ff9
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malicious content. ClamAV identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection scheme. The document body, though heavily obfuscated, contains references to 'Bengali typing keyboard for android' and links to external PDFs, reinforcing the lure-based nature of the attack.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://faberanot.skynetdonate.xyz/uploads/2020/01/27/pawilibofe.pdf In PDF document text
    • http://lowcostphotobooths.co.uk/uploads/1/3/0/3/130379426/26ae0c98b4c061.pdfIn PDF document text
    • http://nileshsp.com/uploads/1/3/0/2/130291676/f7808c98c.pdfIn PDF document text
    • http://404audio.weebly.com/uploads/1/3/0/4/130489128/vevatitebux.pdfIn PDF document text
    • http://bbnla.com/uploads/1/3/0/6/130604892/nuregemirimidib.pdfIn PDF document text
    • https://zizugevowuxovi.weebly.com/uploads/1/3/0/5/130551943/6ace95c121e242.pdfIn PDF document text
    • http://specblend.com/uploads/1/3/0/6/130604369/linivikezode.pdfIn PDF document text
    • http://travistrevisan.net/uploads/1/3/0/4/130436197/bugunavup.pdfIn PDF document text
    • http://bawide.uaenoon.net/uploads/2020/01/27/6351905.pdfIn PDF document text
    • http://rehphotography.org/uploads/1/3/0/6/130639965/130639965.html#bengali+typing+keyboard+for+androidIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001227.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1227 8740 bytes
SHA-256: db49171fbb3d0a685cb8239fb99724feb1537de7220125a2fb332c214f8ed53b
font_01_sfnt_off00005e7d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5E7D 17532 bytes
SHA-256: d7a23342410d97d84b64099cf9b0f8721a1ae592246a174c2573b0c4993ab2ac
font_02_sfnt_off00007829.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7829 2008 bytes
SHA-256: b251e00b4eea5cbc23adf0180395c4102aea23bcfb5d03ea18ed6a7b261a67d7
font_03_sfnt_off000081c0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x81C0 9444 bytes
SHA-256: 9e11a7b808c6f077e77637e615a40b7398075e546a890fa14ee372fee823cb52
font_04_sfnt_off00009bd3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9BD3 10428 bytes
SHA-256: 072978e660dffea8bf99aed85ed9b9dbc9557de53dbd3bf07815eed6e2e276e3

Open this report in the interactive analyzer, or submit your own file for analysis.