Malicious PDF — malware analysis report

Static analysis result for SHA-256 6523959bd3d8636b…

MALICIOUS

PDF

97.9 KB Authoring application: QPDF First seen: 2020-09-04
MD5: e7f5f5ed730fc1a900f7300c155057a7 SHA-1: 65ac3b45bbe27444c1b5fefa57aa890ee418f37c SHA-256: 6523959bd3d8636b6ee48506da0c0e813251f654ebf2384d0f5c9d778eb68a81
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a critical finding for a PDF link farm containing 31 external links. The embedded URLs suggest a phishing or malware distribution campaign. The ML classifier also strongly indicated maliciousness.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rockyridgeacres.org/uploads/1/3/0/4/130489072/674681.pdf In PDF document text
    • http://kunurin.factandi.tech/uploads/2020/01/27/wefofiforonu-jekivejo.pdfIn PDF document text
    • http://zovugominu.wedid.ru/uploads/2020/01/27/348852f02f5.pdfIn PDF document text
    • http://mirigos.tvori-shedevr.ru/uploads/2020/01/28/89bdfb1de2.pdfIn PDF document text
    • http://thecurbcompanyllc.net/uploads/1/3/0/3/130379232/6295261.pdfIn PDF document text
    • http://bmnfire.com/uploads/1/3/0/3/130323914/b761c8cb3d.pdfIn PDF document text
    • https://muxuruwakik.weebly.com/uploads/1/3/0/5/130589220/361793.pdfIn PDF document text
    • http://ligexama.op2r.icu/uploads/2020/01/28/75dca.pdfIn PDF document text
    • http://agm001.icu/uploads/2020/01/27/2671746.pdfIn PDF document text
    • http://log-pool-table.com/uploads/1/3/0/3/130313284/8295349.pdfIn PDF document text
    • http://keepdivealive.com/uploads/1/3/0/6/130640072/61486c7df40.pdfIn PDF document text
    • http://khv-gsm.ru/uploads/2020/01/28/2344099.pdfIn PDF document text
    • http://sumezepon.tailgaitproweb.xyz/uploads/2020/01/29/8254851.pdfIn PDF document text
    • http://vietnamconsult.online/uploads/2020/01/27/fojul.pdfIn PDF document text
    • https://nusukigulol.weebly.com/uploads/1/3/0/5/130539497/basisuvopefumu.pdfIn PDF document text
    • https://vujofonevejum.weebly.com/uploads/1/3/0/5/130551245/gewaj_nasowuzobo_lakukikeledar.pdfIn PDF document text
    • https://bawefomubaduver.weebly.com/uploads/1/3/0/4/130483842/9574073.pdfIn PDF document text
    • https://tuvoluji.weebly.com/uploads/1/3/0/5/130546244/vunenuzaxewavoza.pdfIn PDF document text
    • http://mscbmx.com/uploads/1/3/0/6/130639757/f9556bd8c4a08e.pdfIn PDF document text
    • http://letssimplify.us/uploads/1/3/0/6/130604805/568c09184.pdfIn PDF document text
    • http://zedozowale.agicole-acces.com/uploads/2020/01/28/4813391.pdfIn PDF document text
    • http://ker.difmed.com/uploads/2020/01/29/sepomuwurogolisenu.pdfIn PDF document text
    • http://photosyouask.com/uploads/1/3/0/5/130539597/130539597.html#c+p+w+full+formIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017fd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17FD 8316 bytes
SHA-256: 12a74b754820c189dcde3a916d2380ce08bfc2062f5b673d105ee38930c377ce
font_01_sfnt_off0001049a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1049A 16248 bytes
SHA-256: fb31025025499a0fb01c3c1bd89e32baf051e66ef536a35089523545b6160756
font_02_sfnt_off00011d79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D79 20132 bytes
SHA-256: 9622898eda93030e798e42ddf21425d7def646e8d37d0b9ca2f72fe2479ad70d

Open this report in the interactive analyzer, or submit your own file for analysis.