Malicious PDF — malware analysis report

Static analysis result for SHA-256 940a22d71180f2fc…

MALICIOUS

PDF

70.7 KB Authoring application: Pdftk First seen: 2020-09-24
MD5: 1fa0d02bdb4b0ee4bab1bb144efb2133 SHA-1: b115b0f50e427f57bcc77302c94f1d1a4fe52119 SHA-256: 940a22d71180f2fcb21eb7980f1803023e7a7aa36b6d3c16e87e8257638ac282
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The PDF_SEO_LINK_FARM heuristic specifically identified a large number of external links, with the primary domain being jaxifi.remstroi-metal.ru. This suggests the document's purpose is to act as a lure, redirecting users to potentially harmful content hosted on these external URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jaxifi.remstroi-metal.ru/uploads/2020/01/28/3c3aaa.pdf In PDF document text
    • http://beautyh.pro/uploads/2020/01/28/bofosop.pdfIn PDF document text
    • http://dalidiwe.brainit.ru/uploads/2020/01/27/bapujafove.pdfIn PDF document text
    • http://bogolist.com/uploads/1/3/0/6/130639133/3401252.pdfIn PDF document text
    • https://joginezugetugu.weebly.com/uploads/1/3/0/5/130588304/2a53a38.pdfIn PDF document text
    • http://regalbakeryusa.com/uploads/1/3/0/6/130621865/juzezadilomojem_poxesemogajumi.pdfIn PDF document text
    • https://fujoramewozige.weebly.com/uploads/1/3/0/5/130551585/bagexixim-midakox-lafosoxurak.pdfIn PDF document text
    • http://dvoretc-masterov.ru/uploads/2020/01/28/5870480.pdfIn PDF document text
    • http://matakanacommunitygroup.online/uploads/1/3/0/3/130312920/telibuvowoxazenebi.pdfIn PDF document text
    • https://nigudesamad.weebly.com/uploads/1/3/0/3/130379523/kupakofadasi-divamudikejerox-pisirepuzulak-xutamalezasusur.pdfIn PDF document text
    • http://cakepopsbymaggie.com/uploads/1/3/0/5/130543980/xoduraz_sugokajamebexud.pdfIn PDF document text
    • http://quietpoppy.com/uploads/1/3/0/5/130590096/602280.pdfIn PDF document text
    • http://diocesanconvention2018.org/uploads/1/3/0/2/130291591/ropom-nexidovulavojen-fusukutovad.pdfIn PDF document text
    • http://moveonidiomes.com/uploads/1/3/0/4/130435649/2506593.pdfIn PDF document text
    • http://manchesterrecreationassociation.net/uploads/1/3/0/5/130538995/banizi-lezujujotamoge-dogogo.pdfIn PDF document text
    • http://sazawav.aerogarant.moscow/uploads/2020/01/29/8523947.pdfIn PDF document text
    • http://missrosieweddingsandevents.com.au/uploads/1/3/0/5/130590117/niwedax_kogekipuxozuno_nugapola_pites.pdfIn PDF document text
    • http://dedrickenterprises.com/uploads/1/3/0/5/130539270/xasezosis_zejev_jabizeviziwi_nefub.pdfIn PDF document text
    • http://seed2bowlfarm.com/uploads/1/3/0/5/130588294/130588294.html#elsword+bluhen+guideIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001a4b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1A4B 9368 bytes
SHA-256: 95cbcbab9dbd021e15737e0a28e852c172afdffc99f2e6e2926eb72c56b20208
font_01_sfnt_off00009bd9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9BD9 1764 bytes
SHA-256: 3cf2e61d6a9a17d67058092f735344da68aafd773256a5c2a16702179a7e0181
font_02_sfnt_off0000a3fe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA3FE 2732 bytes
SHA-256: 50224c6c483bfa86a10f62efd7baa2c756f8036c0a911ebd537387e21b2fb6f3
font_03_sfnt_off0000acfe.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xACFE 16036 bytes
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63
font_04_sfnt_off0000c229.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC229 10444 bytes
SHA-256: 4945efb75d44f8d086bbae062e4bd2fd76c9f46ce2d297a3bf145b98d4971634

Open this report in the interactive analyzer, or submit your own file for analysis.