Malicious PDF — malware analysis report

Static analysis result for SHA-256 73c8a5935ab38334…

MALICIOUS

PDF

68.9 KB Authoring application: Adobe PDF Library 9.0 First seen: 2020-08-25
MD5: 91c6d2e4db31e3d893721e7286bac26e SHA-1: a44a5783311d989ca5a1c19e94c6e249e4ef2fbd SHA-256: 73c8a5935ab38334e1604c14f5ccd6212c4434465b96664425f4e268492f691f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 and the ML classifier output strongly suggest malicious intent. The primary attack pattern involves directing users to a multitude of external PDF resources, likely for malicious redirection or SEO spam.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rurostelekomk.ru/uploads/2020/01/27/nukibixozaduwi.pdf In PDF document text
    • http://vijariwu.salonhm.net/uploads/2020/01/28/cb30c2e212e3.pdfIn PDF document text
    • http://tesekadap.tdorestoran.ru/uploads/2020/01/27/1167520.pdfIn PDF document text
    • https://busufovemawut.weebly.com/uploads/1/3/0/4/130483184/dadawivef-kebobura-kavubozit.pdfIn PDF document text
    • http://4gkingdomliving.com/uploads/1/3/0/6/130620689/kenulijubaja.pdfIn PDF document text
    • http://mexicolegalhelp.com/uploads/1/3/0/6/130622116/bodalenupofez_tovelef.pdfIn PDF document text
    • http://muwazus.helpsinstagram.com/uploads/2020/01/28/1694193.pdfIn PDF document text
    • http://merryhillweddings.net/uploads/1/3/0/6/130639530/2042582.pdfIn PDF document text
    • http://mrandmrsmusicco.com/uploads/1/3/0/2/130289154/vorobuvagit.pdfIn PDF document text
    • http://fassil.online/uploads/2020/01/28/dokobibeb_jakanuwesesular_tezotipisit.pdfIn PDF document text
    • http://gereku.sunparkspb.com/uploads/2020/01/27/4605433.pdfIn PDF document text
    • https://pumugutan.weebly.com/uploads/1/3/0/2/130291596/rowaxeruvam.pdfIn PDF document text
    • http://suor.pt/uploads/1/3/0/5/130550844/1259281.pdfIn PDF document text
    • https://mojebuxarijewa.weebly.com/uploads/1/3/0/5/130589297/1b51ac81d60d.pdfIn PDF document text
    • http://numo.scinote.ru/uploads/2020/01/29/4323475.pdfIn PDF document text
    • http://mmjplantation.org/uploads/1/3/0/5/130539366/zixoluruwokaz.pdfIn PDF document text
    • http://simexomu.digitalein.com/uploads/2020/01/28/1110877.pdfIn PDF document text
    • http://50lutions.net/uploads/2020/01/27/zivobupaz_nojotugizizujo.pdfIn PDF document text
    • http://fovepexiwo.rucrime.top/uploads/2020/01/29/97eef354bc.pdfIn PDF document text
    • http://vabe.partizansk-vc.ru/uploads/2020/01/29/fafomaboze_wodanodukebi_favunutan.pdfIn PDF document text
    • http://ayurvedicprinciples.com/uploads/1/3/0/6/130621836/sotugibizux-juxubi-fijoxewof.pdfIn PDF document text
    • http://8danaroad.com/uploads/1/3/0/5/130588956/b79e761bacd4e.pdfIn PDF document text
    • http://flexbeat.pro/uploads/2020/01/28/aa27f85e.pdfIn PDF document text
    • http://qslam.com/uploads/1/3/0/6/130604340/2933361.pdfIn PDF document text
    • http://oakislandhomeowners.org/uploads/1/3/0/3/130313634/130313634.html#bootstrap+material+design+dashboard+templateIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017f3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17F3 8708 bytes
SHA-256: 508958f77dc81aa2eb33a921cc68b65eaebc04e334f8ff23645a44170141bcd9
font_01_sfnt_off0000c74c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC74C 16180 bytes
SHA-256: 669a22844ddb84b64a1d93eb6147c2b8b7ca76f4316fe4be2bbf69c96252e72a

Open this report in the interactive analyzer, or submit your own file for analysis.