Malicious PDF — malware analysis report

Static analysis result for SHA-256 910a290230771965…

MALICIOUS

PDF

43.5 KB Authoring application: QPDF First seen: 2020-09-07
MD5: 4926e9e48f4b220016ad2adbabe59bf0 SHA-1: bdc3eea2c8fb43975b09170ca21a327746083b93 SHA-256: 910a2902307719654b748cc668756578a11ecc22c1d078b6bab82a815facea2f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links predominantly point to PDF files hosted on various domains, suggesting a link farm designed to distribute malicious content or conduct phishing. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pagangarden.com/uploads/1/3/0/5/130541552/540674.pdf In PDF document text
    • http://murraysfools.com/uploads/1/3/0/5/130545816/4d4f3c7fd2a.pdfIn PDF document text
    • http://disabilitymanagmentsolutions.ca/uploads/1/3/0/7/130739559/5353852.pdfIn PDF document text
    • http://3albab.net/uploads/1/3/0/5/130550703/kutujidatoto.pdfIn PDF document text
    • http://lasamazonasdist.com/uploads/1/3/0/8/130814247/wenusajikukodapa.pdfIn PDF document text
    • http://mirrormirrorministries.com/uploads/1/3/0/2/130273733/2734258.pdfIn PDF document text
    • http://alohastudionh.com/uploads/1/3/0/5/130543575/5b698.pdfIn PDF document text
    • http://orangebaseball.org/uploads/1/3/0/5/130588928/guteza.pdfIn PDF document text
    • http://www.steviebillenness.com/uploads/1/3/0/3/130313398/c7b0121e0a.pdfIn PDF document text
    • http://myskiped.com/uploads/1/3/0/5/130540082/2b44bc.pdfIn PDF document text
    • http://candacegraham.com/uploads/1/3/0/7/130738936/regoluso-kemerijo-pozogemugeva.pdfIn PDF document text
    • http://www.headblocks.org/uploads/1/3/0/5/130539768/6378810.pdfIn PDF document text
    • http://austinbrunkhorsthomes.com/uploads/1/3/0/4/130476513/17170c280e.pdfIn PDF document text
    • http://birthdaygiftforwife.net/uploads/1/3/0/5/130539403/golesolunekeruj.pdfIn PDF document text
    • http://mingaretreatcenter.org/uploads/1/3/0/5/130543772/jubotoraponup_rofigovasanita.pdfIn PDF document text
    • http://gardeninglore.com/uploads/1/3/0/7/130740113/2145080.pdfIn PDF document text
    • http://mrandmrslynch.net/uploads/1/3/0/7/130775565/56fc0542737.pdfIn PDF document text
    • http://the-boujee-boutique.com/uploads/1/3/0/7/130740292/rivotasirew.pdfIn PDF document text
    • http://rick8.com/uploads/1/3/0/2/130289426/najivoxeg-voxuzazeva-birosele.pdfIn PDF document text
    • http://yearsofadventures.com/uploads/1/3/0/7/130775722/murowira-xudafux-nexow-kojoxeb.pdfIn PDF document text
    • http://rachelreding.net/uploads/1/3/0/2/130273814/6156057.pdfIn PDF document text
    • http://soilstewards.com/uploads/1/3/0/7/130775211/2c640d12812b8.pdfIn PDF document text
    • http://nadjamoore.com/uploads/1/3/0/4/130483386/5953994.pdfIn PDF document text
    • http://ccamsolutions.com/uploads/1/3/0/4/130477048/zonogis.pdfIn PDF document text
    • http://aammf.bpmtc.com/uploads/1/3/0/5/130588443/130588443.html#icd+10+code+for+acute+gastroenteritis+with+mild+dehydrationIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000045ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x45EF 8416 bytes
SHA-256: 8378307947cf17cc1558a7e4a540257eb0687903d8afdf61cf802fa8866e0258

Open this report in the interactive analyzer, or submit your own file for analysis.