Malicious PDF — malware analysis report

Static analysis result for SHA-256 883b49c033465e32…

MALICIOUS

PDF

73.8 KB Authoring application: QPDF First seen: 2020-09-24
MD5: 2e68e6125ca4ba51a12c337b5f3b3a77 SHA-1: eddba90696abe4d1538152ba55d408e9fdd4170d SHA-256: 883b49c033465e32afc52762f1fd9b2a875dd01be93dedb6f4d72337c35a656c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. While no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to redirect the user to malicious content, potentially leading to further exploitation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fagejalunef.weebly.com/uploads/1/3/0/5/130551697/1162155.pdf In PDF document text
    • http://gurepe.avtovikuppro.ru/uploads/2020/01/28/jukekoba-jadob.pdfIn PDF document text
    • http://nosugu.kropanev.online/uploads/2020/01/28/sagakaditu-bizes-kiloda-luzibizel.pdfIn PDF document text
    • http://fedeke.st-kino.ru/uploads/2020/01/27/0e18c.pdfIn PDF document text
    • https://gejodagisux.weebly.com/uploads/1/3/0/4/130476917/4984751.pdfIn PDF document text
    • http://jup.m-el.ru/uploads/2020/01/28/nerebagid.pdfIn PDF document text
    • http://lemowikabo.gbpfinancials.com/uploads/2020/01/27/xuzavosejojepunazi.pdfIn PDF document text
    • http://sakninhna.com/uploads/2020/01/28/5919161.pdfIn PDF document text
    • http://chicas-saliendo.fun/uploads/2020/01/28/c2372719.pdfIn PDF document text
    • http://rucrime.top/uploads/2020/01/28/zilun.pdfIn PDF document text
    • http://killhost.ru/uploads/2020/01/27/2602402.pdfIn PDF document text
    • https://medukufemu.weebly.com/uploads/1/3/0/5/130550880/8063612.pdfIn PDF document text
    • http://asolar.shop/uploads/2020/01/29/8440073.pdfIn PDF document text
    • http://gaka.thisthoughts.com/uploads/2020/01/28/317208e025e246.pdfIn PDF document text
    • http://aeroagt.com/uploads/1/3/0/2/130287960/130287960.html#hdt+physics+sseIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013b8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13B8 8500 bytes
SHA-256: 1760d0b48c7c06368e807bfd52cdb1dc349d4bbfaa8851eb41b404121f3515f0
font_01_sfnt_off0000c1b6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC1B6 16068 bytes
SHA-256: 6db2f878e0fd57d3a351d0d81a5ccd7b58f68df6728dadc3aee3ebeb1a1d6e60
font_02_sfnt_off0000d604.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD604 2652 bytes
SHA-256: 3d52fc27d04b8b84b219df719738f768697e09c2050136bc1fe69fcddf4eca6e
font_03_sfnt_off0000ded5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDED5 5340 bytes
SHA-256: 170d6932bf44b321e9160df485864fcce144e753550d813ff95f08ec196af36d

Open this report in the interactive analyzer, or submit your own file for analysis.