Malicious PDF — malware analysis report

Static analysis result for SHA-256 860b7a2d84e70c23…

MALICIOUS

PDF

42.8 KB Authoring application: Smallpdf Desktop First seen: 2020-05-14
MD5: 3f89a29bcd3142b9f103de255081c405 SHA-1: 042b0d65e9e29f2dd441ebf7fbca0ae2e4035e65 SHA-256: 860b7a2d84e70c2318fe0864328fdff6b4e84da4f15ce9bb5d8e995288fb3740
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by ClamAV and an ML classifier, and contains a large number of embedded URLs pointing to external PDF files. The document body, though heavily obfuscated, contains references to these URLs, suggesting a coordinated effort to redirect users. The primary function appears to be the distribution of these external resources, potentially for SEO spam or to host further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vajo.baksmans.club/uploads/2020/01/28/2316193.pdf In PDF document text
    • http://kakoda.dienthoaimobile.com/uploads/2020/01/28/9105832.pdfIn PDF document text
    • http://muzserwis.ru/uploads/2020/01/28/452a92e08a4b51.pdfIn PDF document text
    • http://peral.1posvetu.com/uploads/2020/01/28/7212325.pdfIn PDF document text
    • http://fisonabaka.vostok3.ru/uploads/2020/01/28/ca7d272af93bfe.pdfIn PDF document text
    • http://lucky-opros.info/uploads/2020/01/27/buzisomadeniguwetul.pdfIn PDF document text
    • http://kuze.itechieguru.com/uploads/2020/01/27/dakajewakodoxida.pdfIn PDF document text
    • http://gama.mansbestfriendmemorial.com/uploads/2020/01/28/zitok_daziwu_towokujab_lirezafowumobo.pdfIn PDF document text
    • http://dog.rutv.fun/uploads/2020/01/28/8907903.pdfIn PDF document text
    • https://zoguvetom.weebly.com/uploads/1/3/0/3/130323461/916938.pdfIn PDF document text
    • http://guven.swetozar.ru/uploads/2020/01/27/81ebac40e39e87.pdfIn PDF document text
    • http://lovejemchughina.fun/uploads/2020/01/27/xuvuwedoxibek.pdfIn PDF document text
    • http://ximi.likeforinsta.xyz/uploads/2020/01/27/fdde5ed2dc7.pdfIn PDF document text
    • http://marcketplace.online/uploads/2020/01/27/pejemesafetatumo.pdfIn PDF document text
    • http://rejeda.translogistic-svc.com/uploads/2020/01/27/bukudidadimukuwi.pdfIn PDF document text
    • http://xoz.rkmw.ru/uploads/44487312.html#a+workbook+for+argumentsIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013f6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13F6 8192 bytes
SHA-256: 0e8c3e79c2ed92a281486ee9ccfaa346b68e7ccb088448ea66d41d0f67dd0cc2
font_01_sfnt_off000060c5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x60C5 16068 bytes
SHA-256: 6db2f878e0fd57d3a351d0d81a5ccd7b58f68df6728dadc3aee3ebeb1a1d6e60

Open this report in the interactive analyzer, or submit your own file for analysis.