Malicious PDF — malware analysis report

Static analysis result for SHA-256 81a75b68e73247aa…

MALICIOUS

PDF

45.3 KB Authoring application: PDFBox First seen: 2020-09-24
MD5: a27a69d3364931e83c6444e02f474e3a SHA-1: f9da99870201556c6835ab4b3e6779a7f7addf23 SHA-256: 81a75b68e73247aacb9cba7f01cb66ee27a26f9a48d1f21507541bc989869c87
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains a large number of embedded external links, a technique commonly used for SEO poisoning or phishing campaigns. ClamAV and ML classifiers also flagged this file as malicious, specifically identifying it as a phishing attempt. The embedded URLs are the primary indicators of malicious activity, likely leading to further stages of an attack.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mybowtieproduction.com/uploads/1/3/0/5/130551708/defabujizit.pdf In PDF document text
    • http://plumbingworx.com.au/uploads/1/3/0/6/130604621/2815235.pdfIn PDF document text
    • http://complexsyrup.com/uploads/1/3/0/7/130739945/3806963.pdfIn PDF document text
    • http://www.britishinspirationsllc.com/uploads/1/3/0/7/130775131/2551979.pdfIn PDF document text
    • http://privettartgallery.net/uploads/1/3/0/2/130287871/saboxalotij-bufagemisas.pdfIn PDF document text
    • http://bunnycarehome.com/uploads/1/3/0/4/130489926/marawizogisoxok_wutidikos_suduzil.pdfIn PDF document text
    • http://performancexcellence.net/uploads/1/3/0/5/130588511/nubezimopudom-nusazusapake.pdfIn PDF document text
    • http://drome-provence-gite.com/uploads/1/3/0/6/130621321/1e9c7987fee.pdfIn PDF document text
    • http://westernmasssti.com/uploads/1/3/0/3/130379743/644689cc66305a2.pdfIn PDF document text
    • http://mindsets.net/uploads/1/3/0/7/130738681/fewafugufekanak.pdfIn PDF document text
    • http://shuttercraft.nz/uploads/1/3/0/6/130622038/gasepesurexelijabiwe.pdfIn PDF document text
    • http://nirvanatails.net/uploads/1/3/0/5/130539652/nibedagixoxoropelez.pdfIn PDF document text
    • http://mybarbabez.com/uploads/1/3/0/7/130776123/domumamapepawa.pdfIn PDF document text
    • http://vinyl61.net/uploads/1/3/0/7/130740492/5811487.pdfIn PDF document text
    • http://dv8fashionsllc.net/uploads/1/3/0/6/130639258/dbe39.pdfIn PDF document text
    • http://wikipf.com/uploads/1/3/0/5/130550772/fedifiperebesisul.pdfIn PDF document text
    • http://uteo.us/uploads/1/3/0/7/130740158/bifike.pdfIn PDF document text
    • http://stilemans.com/uploads/1/3/0/2/130288426/liwezaxukevafe.pdfIn PDF document text
    • http://www.stefaniconsulting.com/uploads/1/3/0/4/130476171/kuxesubemajodawegasu.pdfIn PDF document text
    • http://newchicagoschool.net/uploads/1/3/0/6/130604446/fujurotolivi-fimiwunovofu-mowobifumexatu.pdfIn PDF document text
    • http://packingoptimizer.net/uploads/1/3/0/6/130639110/d4922.pdfIn PDF document text
    • http://ministeringwithmegan.com/uploads/1/3/0/3/130379285/bc08f35.pdfIn PDF document text
    • http://sheffieldcctvsystems.com/uploads/1/3/0/6/130604179/zupidek_memimubikuxul_lumapiwova.pdfIn PDF document text
    • http://waxwingaerial.com/uploads/1/3/0/6/130621593/1a3c9235.pdfIn PDF document text
    • http://alexmcmichael.com/uploads/1/3/0/7/130776492/130776492.html#accouchement+%C3%A0+domicile+risques+pdfIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004bdb.bin
c4ed788fd52858158df0059e0a7cec1a4208833d6c176f0e1f2429403d7c8723		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4BDB 9592 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.