Malicious PDF — malware analysis report

Static analysis result for SHA-256 7cf2ec1a7a6d3e60…

MALICIOUS

PDF

98.3 KB Authoring application: Mobipocket Creator First seen: 2020-09-24
MD5: 36d570d476c39d25f57f14b688208414 SHA-1: 743d5495c3ade5707fab80e715123c63c4dfcd44 SHA-256: 7cf2ec1a7a6d3e60bad79fa800eb6e05d7fe08e957dd99c55f45f4ed2ca36c2a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as flagged by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly support its malicious nature. The document body's content appears corrupted or is not directly relevant to the malicious functionality.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9955

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nu9empire.com/uploads/1/3/0/5/130546118/30df49.pdf In PDF document text
    • http://brianabrahamactor.com/uploads/1/3/0/4/130488812/3398044.pdfIn PDF document text
    • http://moodage.net/uploads/1/3/0/2/130289577/vadur.pdfIn PDF document text
    • http://mymoneyways.com/uploads/1/3/0/8/130813557/zirojivuzaroxex.pdfIn PDF document text
    • http://watlingst.com/uploads/1/3/0/4/130483239/4120346.pdfIn PDF document text
    • http://webmail.cantatrice.ca/uploads/1/3/0/3/130324241/jikijusetuvepiv.pdfIn PDF document text
    • http://oscarsterte.com/uploads/1/3/0/4/130493476/72e90270abbe97.pdfIn PDF document text
    • http://harperharred.com/uploads/1/3/0/6/130639348/4707b75cd0c95c.pdfIn PDF document text
    • http://divinelove.ca/uploads/1/3/0/6/130640164/rafekovajisek_gomakidigov_vurasiguwo.pdfIn PDF document text
    • http://www.janetgay-counselling.uk/uploads/1/3/0/7/130740213/vefavanilikez.pdfIn PDF document text
    • http://www.piute-high-school.com/uploads/1/3/0/5/130589198/351112.pdfIn PDF document text
    • http://purplestore.net/uploads/1/3/0/6/130621610/79abd07a78f.pdfIn PDF document text
    • http://www.lawsexfineliterature.com/uploads/1/3/0/4/130489131/4474337.pdfIn PDF document text
    • http://host3.carmichaelnl.com/uploads/1/3/0/4/130483852/130483852.html#east+facing+house+vastu+tips+in+tamilIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • http://sinhala.sourceforge.net/In PDF document text
    • http://sinhala.cvs.sourceforge.net/viewvc/*checkout*/sinhala/sinhala/fonts/CREDITSIn PDF document text
    • http://www.gnu.org/licenses/gpl-2.0.htmlIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000026a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x26A7 9164 bytes
SHA-256: d3dee83c98689bebaa190301cb375cd3bcb243d100f21e897253f9bb85c9398e
font_01_sfnt_off0000e627.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE627 4556 bytes
SHA-256: f2b284127ac0aaaab410adaa023c48540a05f5b9ab6e38c40ba88021377eadf5
font_02_sfnt_off0000f56b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xF56B 4772 bytes
SHA-256: 7c203bf3f048399bd0bfcc2b6b9ad0f43ee48e73dfdb55a8ce32a3df1aa4ec1d
font_03_sfnt_off0001044f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1044F 17000 bytes
SHA-256: 5234743bdcbacc7b5fb5ba8b37fc4a52523753677715d366b5c16a5aa9a80f4a
font_04_sfnt_off00011c2b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11C2B 1844 bytes
SHA-256: ea3dc1d1c6b158f51805120729441ddc4412905df9da1f241f53e5f5a0cbb6e7
font_05_sfnt_off0001252f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1252F 7712 bytes
SHA-256: f636ae314f95f4f1b04f06cfa8c0ce088a2f4d626de80eac625906acce678eb3
font_06_sfnt_off0001397d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1397D 8892 bytes
SHA-256: cfec225636dbb7c7f198cd8d10dab75ff2cfe5e452a7a3c0e2e95b6ee1197075

Open this report in the interactive analyzer, or submit your own file for analysis.