Malicious PDF — malware analysis report

Static analysis result for SHA-256 84afe92e39159461…

MALICIOUS

PDF

39.8 KB Authoring application: pstoedit First seen: 2020-09-04
MD5: ef4becabef6f5ad8f582092b3fbca148 SHA-1: 224de04c24389f80d4f681d896a63540571e8ca3 SHA-256: 84afe92e39159461fd19f46492018136d8db9924d8a2cbad6aaad9e40f469339
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier further indicate malicious intent. The primary attack pattern involves directing users to a network of suspicious PDF files hosted on various domains, likely to facilitate phishing or distribute further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ellabelleslime.com/uploads/1/3/0/5/130551823/5a4b905d06.pdf In PDF document text
    • http://liveinemail.net/uploads/1/3/0/7/130740512/vadobomoban-kebevinuxi-gudavevawef-powapepolunu.pdfIn PDF document text
    • http://webmail.softysgym.com/uploads/1/3/0/2/130272415/fapovazisu.pdfIn PDF document text
    • http://koalastats.com/uploads/1/3/0/2/130273610/9676690.pdfIn PDF document text
    • http://soloptometry.com/uploads/1/3/0/3/130323271/lidotivejeb.pdfIn PDF document text
    • http://certvrs.com/uploads/1/3/0/6/130620666/durafatowaxafeg.pdfIn PDF document text
    • http://chuckatucktradingpost.com/uploads/1/3/0/7/130775665/9827865.pdfIn PDF document text
    • http://www.kencking.com/uploads/1/3/0/6/130622047/fepixiv.pdfIn PDF document text
    • http://royalty-racing.com/uploads/1/3/0/6/130605517/1a2b83b8.pdfIn PDF document text
    • http://dogbonetech.com/uploads/1/3/0/2/130270955/zibik_jexutunuje_bojabeda.pdfIn PDF document text
    • http://jhughesconsultingllc.com/uploads/1/3/0/6/130604973/4e67ccfa3e4de85.pdfIn PDF document text
    • http://internationalrealestateinvestmentforum.com/uploads/1/3/0/6/130604487/redefumivememo-netefomejek-pujewibix.pdfIn PDF document text
    • http://ctsretreat.com/uploads/1/3/0/4/130475964/4143913.pdfIn PDF document text
    • http://audiorewind.com/uploads/1/3/0/4/130476066/9303997986b0ef.pdfIn PDF document text
    • http://www.danielevangelista.com/uploads/1/3/1/0/131070652/1fb47.pdfIn PDF document text
    • http://0ws5k.bpmtc.com/uploads/1/3/0/2/130271108/130271108.html#employee+accident+report+form+docIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c51.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C51 16036 bytes
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63
font_01_sfnt_off00004311.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4311 6996 bytes
SHA-256: b632d9208e75713ef5aff7dbfd76aaba72b230b5288244401851650ce49bb8a6

Open this report in the interactive analyzer, or submit your own file for analysis.