Malicious PDF — malware analysis report

Static analysis result for SHA-256 8204c4dfe4962592…

MALICIOUS

PDF

40.6 KB Authoring application: Soda PDF First seen: 2020-09-07
MD5: a571221ed58f77dc94d6e1e7f4d63ded SHA-1: c7c20fbd80e21b722e4fcbf01e9100bffb354fc6 SHA-256: 8204c4dfe4962592c28c9fa320e292afa3bbd3a79c4a4659ed9a05a24eba5118
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a mass external link farm, with numerous URLs pointing to other PDF files, suggesting a phishing or scam campaign. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to distributing further malware or phishing content. No scripts were extracted, but the embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://shieldbearer.us/uploads/1/3/0/4/130490561/2737201.pdf In PDF document text
    • http://trentriverdesigns.com/uploads/1/3/0/7/130775868/cdf86a2b68e.pdfIn PDF document text
    • http://cruisesceptic.com/uploads/1/3/0/6/130620602/6373600.pdfIn PDF document text
    • http://www.cobs71.com/uploads/1/3/0/6/130603928/wogemuxalazezarubu.pdfIn PDF document text
    • http://modelsenden.com/uploads/1/3/0/5/130541552/topilidarevigifut.pdfIn PDF document text
    • http://wiredweird.net/uploads/1/3/0/6/130639554/fe44ad5.pdfIn PDF document text
    • http://dadevilleband.com/uploads/1/3/0/6/130620747/wiragomomonez_punozi_tisigereradafel_jekubiguvodova.pdfIn PDF document text
    • http://solit.studio/uploads/1/3/0/5/130545421/taximepulatebo-zifave-minuwi.pdfIn PDF document text
    • http://www.andreaschwartzitcc.com/uploads/1/3/0/3/130323425/jugijewikul_pidapezojenar.pdfIn PDF document text
    • http://hiphopexperiment.com/uploads/1/3/0/6/130620708/vezuzitu.pdfIn PDF document text
    • http://ninja411.com/uploads/1/3/0/5/130589108/f1e65d.pdfIn PDF document text
    • http://nuohotel-zh.devsite-1.com/uploads/1/3/0/5/130588291/130588291.html#how+to+insert+text+function+in+excelIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003435.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3435 4236 bytes
SHA-256: d5ed1c3e32e121bc7fdf4b7f64e9f52042883cdc8d0b4eb1f0c73bff7e2be32e
font_01_sfnt_off0000448c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x448C 8936 bytes
SHA-256: a972a418c82e36ca10c0b71c0cccdbc538db6d9b2089046a79b17d042e6fbec1

Open this report in the interactive analyzer, or submit your own file for analysis.