Malicious PDF — malware analysis report

Static analysis result for SHA-256 7df05559654557be…

MALICIOUS

PDF

34.6 KB Authoring application: Mobipocket Creator First seen: 2020-09-07
MD5: 2451990fb5cf59f0cd5396fe4229b042 SHA-1: 078e1e18e8b0f126737a5f2356954e32eeaf0013 SHA-256: 7df05559654557bec591d306df445b24c0c13e94966afc0bbce0381b55eadfd9
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to other PDF files hosted on various domains, suggesting a link farm or distribution mechanism. The ClamAV detection and ML classifier further indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ns2.becksusedappliances.com/uploads/1/3/0/7/130739662/vutubusarugip-musar-widerinor-bemeg.pdf In PDF document text
    • http://carverarms.com/uploads/1/3/0/2/130272994/xufunuzaf.pdfIn PDF document text
    • http://whm.cc-creativecomms.com/uploads/1/3/0/3/130313340/botumupukog.pdfIn PDF document text
    • http://evernightmoon.com/uploads/1/3/0/6/130604582/sosotak-kagusexugakebop-jewuzo.pdfIn PDF document text
    • http://wer4jesus.com/uploads/1/3/0/7/130740496/gijaxatexivevove.pdfIn PDF document text
    • http://knowsbest.net/uploads/1/3/0/6/130639691/xobufikejelole.pdfIn PDF document text
    • http://rachelmcoburn.net/uploads/1/3/0/7/130740217/vetobefo_mimanoposujigis_bafozusazetija.pdfIn PDF document text
    • http://rawhidemotel.com/uploads/1/3/0/4/130436173/simexekomekaz.pdfIn PDF document text
    • http://elysianresources.us/uploads/1/3/0/4/130488338/a9bb3.pdfIn PDF document text
    • http://countylinelogisticscenter.com/uploads/1/3/0/4/130492771/zokutifofolugoz.pdfIn PDF document text
    • http://balboacapitalgroup.com/uploads/1/3/0/7/130776272/folixub.pdfIn PDF document text
    • http://numeracyshed.com/uploads/1/3/0/4/130435922/50831af4e9ec.pdfIn PDF document text
    • http://sparkmechanical.com/uploads/1/3/0/5/130588216/0d3262.pdfIn PDF document text
    • http://dronecoaches.com/uploads/1/3/0/6/130621132/2c2c5ba.pdfIn PDF document text
    • http://acumensalestrainingconsultants.com/uploads/1/3/0/7/130776083/5042153.pdfIn PDF document text
    • http://smtp1.tandem-co.com/uploads/1/3/0/8/130874606/tunupuxu-luladozusenet-benagarajefibu-bovisas.pdfIn PDF document text
    • http://www.neemsounds.com/uploads/1/3/0/5/130551188/wobituwunero_katirumududi_foradow.pdfIn PDF document text
    • http://docspaces.com/uploads/1/3/0/5/130541004/tovinu_kaxez_mevod_woxofer.pdfIn PDF document text
    • http://wayjayjetwas.com/uploads/1/3/0/3/130312964/pomedobigolutovaduji.pdfIn PDF document text
    • http://guoshengwangshangyule.br3h.com/uploads/1/3/0/8/130874629/130874629.html#the+concise+cambridge+history+of+english+literature+by+george+sampsonIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000028ff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x28FF 7492 bytes
SHA-256: 85bd407294b4a7657284d4c663b93e18293731216cf902fd35e0519f9b231416

Open this report in the interactive analyzer, or submit your own file for analysis.