Malicious PDF — malware analysis report

Static analysis result for SHA-256 85d78f2d0a5de36c…

MALICIOUS

PDF

52.4 KB Authoring application: Nitro PDF First seen: 2020-09-24
MD5: 881b8e5862745caa8c81b66686c6651c SHA-1: 4761fbb1362875e3bfebb7bd725314e391e2b0ea SHA-256: 85d78f2d0a5de36c2ee6987b9214ede98febaaec79fc37f235fda82b9f0e25b3
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also indicate maliciousness, specifically flagging it as phishing-related. While no scripts were explicitly extracted, the nature of the link farm suggests an attempt to redirect users to potentially malicious sites or engage in SEO spam, which is a common tactic for phishing and malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fancysneaker.com/uploads/1/3/0/5/130539016/sekafefapito.pdf In PDF document text
    • http://jolenesphotography.com/uploads/1/3/0/6/130605146/f764e.pdfIn PDF document text
    • http://www.mybarbabez.com/uploads/1/3/0/7/130775135/wutisomobepeteb-mewuzozu-nimud.pdfIn PDF document text
    • http://camptishomingo.org/uploads/1/3/0/5/130550731/3001335.pdfIn PDF document text
    • http://www.shannonoberry.org/uploads/1/3/0/8/130813604/49f112be.pdfIn PDF document text
    • http://alcft.com/uploads/1/3/0/7/130738940/5f1a4883d2.pdfIn PDF document text
    • http://esg-wire.com/uploads/1/3/0/7/130738863/mebaxakolu.pdfIn PDF document text
    • http://smartlets.org/uploads/1/3/0/7/130776425/bozoxefozo.pdfIn PDF document text
    • http://livinginsight.biz/uploads/1/3/0/2/130272353/nolupetutaw.pdfIn PDF document text
    • http://nilaskanltd.com/uploads/1/3/0/4/130483050/mepimep.pdfIn PDF document text
    • http://constructionblogging.com/uploads/1/3/0/6/130603982/7d51d3be60f518.pdfIn PDF document text
    • http://the-way-of-life-blog.com/uploads/1/3/0/7/130738974/7520231.pdfIn PDF document text
    • http://daybreakerstest.com/uploads/1/3/0/2/130272472/db84840d70f070.pdfIn PDF document text
    • http://paskes.com/uploads/1/3/0/8/130874329/ditupasoma.pdfIn PDF document text
    • http://oliveraconst.com/uploads/1/3/0/4/130483337/3054150.pdfIn PDF document text
    • http://musette-ventures.com/uploads/1/3/0/2/130289669/58394.pdfIn PDF document text
    • http://aclifesciences.biz/uploads/1/3/0/2/130289426/dazajigokulisu-tajumefif-beduxibogij.pdfIn PDF document text
    • http://relaysocial.net/uploads/1/3/0/4/130435941/9160452.pdfIn PDF document text
    • http://opossumpouchwildlife.com/uploads/1/3/0/8/130814297/nufiwukedi_tenozikedome.pdfIn PDF document text
    • http://mynukshuk.com/uploads/1/3/0/5/130590413/5893533.pdfIn PDF document text
    • http://drobgyn.net/uploads/1/3/0/5/130589222/130589222.html#sda+shona+hymnal+bookIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000e77.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE77 7372 bytes
SHA-256: a18d57e069899a926ed3ffe330de3f19272a29d6b76bf190cff88c0a7acf9ad3

Open this report in the interactive analyzer, or submit your own file for analysis.