Malicious PDF — malware analysis report

Static analysis result for SHA-256 87ea9f38b1ee5e22…

MALICIOUS

PDF

36.5 KB Authoring application: PDFBox First seen: 2020-09-24
MD5: e410785830b15335c3029a832d62d0fa SHA-1: db430bd7546f00a00d5883899f72d62b7bfbbc63 SHA-256: 87ea9f38b1ee5e2204a151d0850efc51a4f1c530338c771520f6e5e8bc3cc2f0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm, likely used for SEO poisoning or to distribute further malicious content. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nckphotography.com/uploads/1/3/0/6/130604458/d7a08f11122d3e.pdf In PDF document text
    • http://metconengineering.ca/uploads/1/3/0/4/130483184/64404178.pdfIn PDF document text
    • http://mountainofgod.org/uploads/1/3/0/5/130541103/vurutozuj_ledas_datilanosugok.pdfIn PDF document text
    • http://naturecalling.us/uploads/1/3/0/6/130604876/3954d5c6f2.pdfIn PDF document text
    • http://royleighton.com/uploads/1/3/0/6/130620828/wewuva.pdfIn PDF document text
    • http://keeganvanmaanen.com/uploads/1/3/0/5/130589396/xukakeporexaz-kadireponukexa-rubapipix.pdfIn PDF document text
    • http://dandglettings.com/uploads/1/3/0/7/130739956/fubagitilapo_konirolururobiz_lipedonuzuxap_zudozemoxubep.pdfIn PDF document text
    • http://www.cihas.org/uploads/1/3/0/7/130776150/73724aaa70eea83.pdfIn PDF document text
    • http://calljasonmyers.com/uploads/1/3/0/5/130589281/puxofizat.pdfIn PDF document text
    • http://silkroadsourcing.co/uploads/1/3/0/7/130740001/kalazafabubibulutuw.pdfIn PDF document text
    • http://merlotagency.com/uploads/1/3/0/3/130313114/duxutaf_bovupepemo_tizudo.pdfIn PDF document text
    • http://www.richmondgroup.org/uploads/1/3/0/7/130775521/d50b965c7ae70.pdfIn PDF document text
    • http://artofyiannipasamihalis.com/uploads/1/3/0/6/130639883/lapurulajetogu.pdfIn PDF document text
    • http://modish716.com/uploads/1/3/0/4/130476098/3084629.pdfIn PDF document text
    • http://www.mollylizzio.com/uploads/1/3/0/4/130477309/92f7a4cd402.pdfIn PDF document text
    • http://toptreeservicerosevilleca.com/uploads/1/3/0/3/130313324/527692.pdfIn PDF document text
    • http://castawaycustomsmidwest.com/uploads/1/3/0/3/130313037/lanewisevub.pdfIn PDF document text
    • http://feriadeinternet.com/uploads/1/3/0/8/130814559/tujavedalabiw-xomub.pdfIn PDF document text
    • http://lucidpapercuts.com/uploads/1/3/0/6/130639495/a5763bafb61c.pdfIn PDF document text
    • http://montanapurewood.com/uploads/1/3/0/6/130639943/130639943.html#valve+tray+distillation+column+designIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000312b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x312B 7412 bytes
SHA-256: 9bfde241808a4f0a1d83efa94bfa028470586fa2e3a28e7ed92f5856e7f2b0e4

Open this report in the interactive analyzer, or submit your own file for analysis.