Malicious PDF — malware analysis report

Static analysis result for SHA-256 81f64443a719cdb5…

MALICIOUS

PDF

42.7 KB Authoring application: Poppler-utils First seen: 2020-09-24
MD5: 70019b59d37edc8559123e6079a53e29 SHA-1: ea8896673ec245b6d0729e814f3f12ba1fab5d95 SHA-256: 81f64443a719cdb5560e613444366c346928cbcf06cc6d1db22260742ebf84b3
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute further malicious content. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a machine learning classifier also flagged it as malicious. The embedded URLs are the primary indicators of malicious activity.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://pumutuwido.weebly.com/uploads/1/3/0/2/130288761/viliwubat.pdf In PDF document text
    • http://vopa.shortcutviralnews.com/uploads/2020/01/28/kiwipideg-jukirofoz.pdfIn PDF document text
    • http://laneju.td-detstvo.org/uploads/2020/01/27/sosamumupa_fipiji.pdfIn PDF document text
    • http://jug.binancedex-giveaway.com/uploads/2020/01/27/wamuluzusafewug-fitazaxafuduwug.pdfIn PDF document text
    • http://dumusufaji.proastrologiu.ru/uploads/2020/01/27/biwaxujizosaxon.pdfIn PDF document text
    • http://find-me-2019.com/uploads/2020/01/27/nomosemitaz_famalut_sudukosoken_sezewurabus.pdfIn PDF document text
    • http://xete.dream-boxxx.ru/uploads/2020/01/27/b399044acf8d.pdfIn PDF document text
    • http://legaxop.kitai-journal.ru/uploads/2020/01/27/jazipedutepusiboku.pdfIn PDF document text
    • http://dute.hayatimbirfilm.com/uploads/2020/01/28/gajuredoxu.pdfIn PDF document text
    • http://bonita-casa.ru/uploads/2020/01/27/fuzemelu_lefamujumujug_pimivap.pdfIn PDF document text
    • http://netix.supershopes.icu/uploads/2020/01/28/zixunumaw.pdfIn PDF document text
    • http://tizamubov.infonetacademy.tech/uploads/2020/01/28/jijilenof.pdfIn PDF document text
    • http://wubedivuv.c-5527.ru/uploads/2020/01/27/3341251.pdfIn PDF document text
    • https://morarafaf.weebly.com/uploads/1/3/0/5/130590224/130590224.html#best+ab+exercises+for+lower+tummyIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013a2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13A2 7860 bytes
SHA-256: 4590ccf155b65fadf4c1cc92f691e9dc4c611ce10e6c7ecbb3aae40856669993

Open this report in the interactive analyzer, or submit your own file for analysis.