Malicious PDF — malware analysis report

Static analysis result for SHA-256 87d4fe4ba79a6e47…

MALICIOUS

PDF

37.3 KB Authoring application: QPDF First seen: 2020-09-04
MD5: 8a3bec3c4274f2440f4f8b99f2dcb91a SHA-1: 2c1b59b090a63d5625abbe817087e64c7973b950 SHA-256: 87d4fe4ba79a6e479a6d91baaf8274f4e48174e427c17069f59e41dc6864b5e4
220 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous links to external PDF files, many with numeric slugs, indicative of a link farm designed to host malicious content. The document body, though heavily obfuscated, contains keywords related to financial documents like 'Letter of credit' and 'bank guarantee', aligning with the 'SE_INVOICE_LURE' heuristic. The presence of multiple PDF link farm heuristics and a high ML score strongly suggests this PDF is part of a phishing campaign to deliver further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 6

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thebao.house/uploads/1/3/0/7/130738805/1779174.pdf In PDF document text
    • http://mytextsandhumanexperiences.com/uploads/1/3/0/5/130551302/patunoledos.pdfIn PDF document text
    • http://dstuddistributing.com/uploads/1/3/0/5/130589362/5a3e8cfe48d2591.pdfIn PDF document text
    • http://musclehamsterfitness.com/uploads/1/3/0/2/130272282/65154.pdfIn PDF document text
    • http://playtherapyonlinetrainingacademy.com/uploads/1/3/0/3/130379239/9101531.pdfIn PDF document text
    • http://nicholaspaulmccarty.com/uploads/1/3/0/5/130539992/705f3e88a2a1.pdfIn PDF document text
    • http://gallery1019.org/uploads/1/3/0/5/130551718/funod.pdfIn PDF document text
    • http://www.tairuaholidaypark.com/uploads/1/3/0/8/130874090/vupiwa-jigexugukaxegud-lorapesepe.pdfIn PDF document text
    • http://yachtrock.biz/uploads/1/3/0/6/130622093/bosorubu_limezenagovatix.pdfIn PDF document text
    • http://earthspiritpath.com/uploads/1/3/0/6/130620635/figukobojixu_faxiwemaretum.pdfIn PDF document text
    • http://metroartdesign.com/uploads/1/3/0/7/130738632/logugakemol.pdfIn PDF document text
    • http://607.bpmtc.com/uploads/1/3/0/7/130776101/5760607.pdfIn PDF document text
    • http://1s8ne0.salon225.com/uploads/1/3/0/2/130289448/130289448.html#letter+of+credit+and+bank+guarantee+pdfIn PDF document text
🗂 Part of campaign: 127onyork.com 4 samples

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003af2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3AF2 7740 bytes
SHA-256: f05c2a4cd309624f338c8808d6fe8a0dcc8e1c41311bd84370e16e08d089500f

Open this report in the interactive analyzer, or submit your own file for analysis.