Malicious PDF — malware analysis report

Static analysis result for SHA-256 780668251daa3cbc…

MALICIOUS

PDF

39.6 KB Authoring application: Smallpdf Desktop First seen: 2020-09-07
MD5: 3beded00571804020af6f72fb00aa82d SHA-1: 5d799c840231d87678a8c3495a817ae64d981228 SHA-256: 780668251daa3cbcbe684b16551d8be4416b992a4bbd0f7dfabd34028f205e72
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The ML classifier also strongly flagged this PDF as malicious. No scripts were extracted from this sample, but the extensive URL distribution points to a phishing or content-spreading attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://savvynotary.com/uploads/1/3/0/5/130540010/db477eb6177630.pdf In PDF document text
    • http://kylewidner.com/uploads/1/3/0/2/130273791/0f3feba17.pdfIn PDF document text
    • http://robinreitzes.com/uploads/1/3/0/7/130775682/7724755.pdfIn PDF document text
    • http://thisweeksbestdeals.com/uploads/1/3/0/4/130475964/bcb519.pdfIn PDF document text
    • http://duilawvt.net/uploads/1/3/0/7/130739782/xiwizomifuzumufukufi.pdfIn PDF document text
    • http://conqueracademy.com/uploads/1/3/0/5/130551054/f2030c46fe0f.pdfIn PDF document text
    • http://hostmaster.gdub.tv/uploads/1/3/0/6/130605383/mipusetanuv.pdfIn PDF document text
    • http://nicolas-rigaux-photographe.com/uploads/1/3/0/4/130489727/2728059.pdfIn PDF document text
    • http://kjerstikveli.net/uploads/1/3/0/6/130604951/2592907.pdfIn PDF document text
    • http://richmondfutsal.com/uploads/1/3/0/6/130603913/vutavupa-duwavavovamem-nalegilezew-kevetabofixo.pdfIn PDF document text
    • http://commandlineidiot.com/uploads/1/3/0/6/130620788/9822927.pdfIn PDF document text
    • http://rrrtag.com/uploads/1/3/0/2/130287527/xutelinuwuxe-pagon-gojegaxi.pdfIn PDF document text
    • http://justgreatcareers.com/uploads/1/3/0/3/130380002/6b72160db43.pdfIn PDF document text
    • http://queenbeenails.net/uploads/1/3/0/5/130543065/aa60b62ee1ccc4.pdfIn PDF document text
    • http://mrsottocounselingcorner.com/uploads/1/3/0/4/130483638/be295db8dd.pdfIn PDF document text
    • http://mixlegacy.com/uploads/1/3/0/4/130476320/cae6d0e042.pdfIn PDF document text
    • http://a.marisths.org/uploads/1/3/0/7/130739618/porojonilumel.pdfIn PDF document text
    • http://heeratees.com/uploads/1/3/0/7/130775429/duxaborurowe_suxar_dojiruzebi_bajuruja.pdfIn PDF document text
    • http://twinitron.com/uploads/1/3/0/6/130639990/9866388.pdfIn PDF document text
    • http://designguard.us/uploads/1/3/0/5/130544468/tebutaz.pdfIn PDF document text
    • http://loneymetalworks.com/uploads/1/3/0/3/130379285/ruruni_donupunow.pdfIn PDF document text
    • http://mynaturalhairspa.com/uploads/1/3/0/3/130323163/5434449.pdfIn PDF document text
    • http://bandgphotography.info/uploads/1/3/0/7/130738684/sorel.pdfIn PDF document text
    • http://sewbusy.net/uploads/1/3/0/7/130739147/fixodowijik.pdfIn PDF document text
    • http://tangball-online.lucky1st.com/uploads/1/3/0/4/130435850/130435850.html#apache+airflow+vs+jenkinsIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003980.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3980 7304 bytes
SHA-256: ee21851bc9f3dfd2a26cf76e15a453fa83ec7bed38b4c7b73b15064afd2d5dc5

Open this report in the interactive analyzer, or submit your own file for analysis.