Malicious PDF — malware analysis report

Static analysis result for SHA-256 8907199c5ecae169…

MALICIOUS

PDF

38.6 KB Authoring application: PDFBox First seen: 2020-09-07
MD5: 1202e40a1179500b51a7aa12573d41ee SHA-1: 5798777dc0427040aa0876d33cb00c52be7f1ddb SHA-256: 8907199c5ecae1694286a93103ea3308d8de1cb2fdcd99646ba78dbad7dc2e00
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. It contains a large number of embedded URLs, suggesting a link farm designed to redirect users to potentially harmful content. The presence of these links and the overall structure indicate a phishing or malware distribution attempt, likely delivered as a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://makevotingmatter.net/uploads/1/3/0/5/130538945/7025517.pdf In PDF document text
    • http://mrtexel.com/uploads/1/3/0/5/130550774/334287.pdfIn PDF document text
    • http://molasobi.viptip.pro/uploads/2020/01/27/7906391.pdfIn PDF document text
    • http://woperazi.kultivator-tornado.xyz/uploads/2020/01/28/a321ed1e83bf73a.pdfIn PDF document text
    • http://wallwalkers2015.com/uploads/1/3/0/3/130379681/galufuloweniru_bozativir_wanijokeme.pdfIn PDF document text
    • https://jisuxekam.weebly.com/uploads/1/3/0/5/130590278/6185836.pdfIn PDF document text
    • https://sigesavipubofi.weebly.com/uploads/1/3/0/3/130323392/24627aa8.pdfIn PDF document text
    • http://bigexak.geltser.info/uploads/2020/01/27/3724881.pdfIn PDF document text
    • https://xakokazamajo.weebly.com/uploads/1/3/0/5/130544652/pewula.pdfIn PDF document text
    • http://jegiruw.darkempires.ca/uploads/2020/01/27/marumen.pdfIn PDF document text
    • http://remepumuja.ttkhelo.com/uploads/2020/01/28/luxeriwofobarek_paxewuzuje.pdfIn PDF document text
    • https://lizekogos.weebly.com/uploads/1/3/0/5/130547150/3253030.pdfIn PDF document text
    • http://lodur.event-essence.com/uploads/2020/01/28/4f50ac4f4.pdfIn PDF document text
    • http://cfthomas.com/uploads/1/3/0/3/130324451/130324451.html#personal+pronoun+and+possessive+pronoun+worksheetsIn PDF document text
🗂 Part of campaign: getkmaccontent.com 6 samples

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000155a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x155A 8276 bytes
SHA-256: 35f9c2749326a07f10ec2786e9020e980886816c13635a2d6b72ccd790d38a32

Open this report in the interactive analyzer, or submit your own file for analysis.