Malicious PDF — malware analysis report

Static analysis result for SHA-256 830b566cbb3704e2…

MALICIOUS

PDF

47.9 KB Authoring application: Smallpdf Desktop
MD5: a7d8ba88d3e1b138dd7f79d818bc6bb6 SHA-1: a7510bfa6a134bf2fb2d20d6396df504f5bdb10f SHA-256: 830b566cbb3704e2c743a2ac660ba03693a3be214dad92462b7fdfda88c4803c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The document body mentions 'Update android samsung tab 2', suggesting a lure to trick users into clicking these links. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. The numerous embedded URLs likely lead to malicious sites designed to exploit or phish users.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pureluxsalon.com/uploads/1/3/0/5/130550789/retemejexof-mibakezum.pdf
    • http://barbuil.com/uploads/1/3/0/3/130379352/9abf611ff.pdf
    • http://vaju.chaskyboompark.net/uploads/2020/01/28/8091368.pdf
    • http://audreyacosta.com/uploads/1/3/0/4/130489898/pesidajovinezawima.pdf
    • http://bpoconcierge.com/uploads/1/3/0/4/130483397/vapem_konedewa_dobewisuvarelew_guxazazusixobab.pdf
    • http://actorheadshotphoto.com/uploads/1/3/0/6/130605212/nefimovifidu_lufuvegumaga_fadobo.pdf
    • http://4therestofus.com/uploads/1/3/0/6/130639145/6301466.pdf
    • http://onewesterra.com/uploads/1/3/0/6/130604522/lagisexot_tepewalaj_xodurituful.pdf
    • http://northernrailleaders.com/uploads/1/3/0/5/130590334/130590334.html#update+android+samsung+tab+2

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001238.bin
57e2f7747056dcb09cd0d7cb76c944e824c8fa02665c2e064114545464618c3d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1238 8744 bytes
font_01_sfnt_off0000743c.bin
033b7f1ba061febecaf2fef4b156c1a3a46196357f49618ab3ef6b2be9d4a1a6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x743C 16340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.