Malicious PDF — malware analysis report

Static analysis result for SHA-256 94035b839972221d…

MALICIOUS

PDF

61.9 KB Authoring application: Pdftk First seen: 2020-09-24
MD5: a922a26d9be17ee6c4fd1e20ed647d48 SHA-1: 09694902da8c883db7e0cb29f82cb9f856c16dbd SHA-256: 94035b839972221df9db66c88db935f18c886bb92e1784e22f113169978d626e
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm, with 31 links pointing to various domains. This is a strong indicator of SEO manipulation or a phishing lure. The ClamAV detection and ML classifier further support its malicious nature. No scripts were extracted, and the document body was heavily obfuscated, making it difficult to determine a more specific attack pattern beyond link distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://krhphotography.com/uploads/1/3/0/2/130289453/zabokegej.pdf In PDF document text
    • http://1objektiv.virtus.hu/uploads/1/3/0/4/130491253/jariniliwugite.pdfIn PDF document text
    • http://meroveo-officedistribution.store/uploads/1/3/0/2/130291572/527792.pdfIn PDF document text
    • http://www.therunwaycoach.nl/uploads/1/3/0/2/130288551/furidedafidij-sawaj-bonokidexi-jumegomorozajew.pdfIn PDF document text
    • http://www.christopherwood.org/uploads/1/3/0/5/130588511/2899813.pdfIn PDF document text
    • http://trialsacademy.com.au/uploads/1/3/0/8/130874429/woleneto.pdfIn PDF document text
    • http://3gatewaycenter.com/uploads/1/3/0/7/130740217/lozela.pdfIn PDF document text
    • http://www.bermanlawpc.com/uploads/1/3/0/8/130813372/c710dd7.pdfIn PDF document text
    • http://casettedemo.com/uploads/1/3/0/6/130620519/vomiv.pdfIn PDF document text
    • http://purebark.com/uploads/1/3/0/4/130488476/9893284.pdfIn PDF document text
    • http://www.srca.co.uk/uploads/1/3/0/5/130589036/1460340.pdfIn PDF document text
    • http://feelgoodprice.com/uploads/1/3/0/2/130271219/nimevikadi_bumemixifabew.pdfIn PDF document text
    • http://actressmodelsuperstar.com/uploads/1/3/0/7/130738812/zisirazixifigimod.pdfIn PDF document text
    • http://billingsequestrian.com/uploads/1/3/0/6/130620719/7219504.pdfIn PDF document text
    • http://www.osorio-avocat.com/uploads/1/3/0/3/130323659/wijiguzuruwo_vumepofupo_wuraze_votejidaduju.pdfIn PDF document text
    • http://mapleleafmarketing.ca/uploads/1/3/0/4/130489253/sesuritigope-gosivagoxi.pdfIn PDF document text
    • http://stadiumpubgrille.com/uploads/1/3/0/2/130270790/ac9d845c43ef.pdfIn PDF document text
    • http://idcnyc.com/uploads/1/3/0/7/130776316/f2b2155f7c1133.pdfIn PDF document text
    • http://ashlanddetailing.com/uploads/1/3/0/7/130776132/be66bda.pdfIn PDF document text
    • http://katiegbryant.com/uploads/1/3/0/2/130270792/sofukoziro_vuduru.pdfIn PDF document text
    • http://insuranceexecutive.net/uploads/1/3/0/7/130775539/baberotawobu.pdfIn PDF document text
    • http://splinteredmindshirts.com/uploads/1/3/0/5/130551266/3d6061a.pdfIn PDF document text
    • http://jbheatonresearch.net/uploads/1/3/0/7/130739967/62e2044e3f2.pdfIn PDF document text
    • http://roaringnews.com/uploads/1/3/0/8/130874429/radutanotoze.pdfIn PDF document text
    • http://a1893059xstreamtravel.xsideas.com/uploads/1/3/0/8/130813332/130813332.html#gujarat+samachar+newspaper+ahmedabad+todayIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004513.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4513 25716 bytes
SHA-256: a1dfedc2a05308503374a2409c94c0ed6c7696d1965b67032c4f236052733081
font_01_sfnt_off000082be.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x82BE 2652 bytes
SHA-256: e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea
font_02_sfnt_off00008eaf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8EAF 8236 bytes
SHA-256: 6fdb0cfb124f27136798df078baa2994f0ca20996749cce0b759968d5c670120

Open this report in the interactive analyzer, or submit your own file for analysis.