Malicious PDF — malware analysis report

Static analysis result for SHA-256 9a2db567b018920d…

MALICIOUS

PDF

47.5 KB Authoring application: pstoedit First seen: 2020-07-24
MD5: e7f49d43e4a1801a8e7136666f98abdb SHA-1: 62cea661f39005933663989af3d76e8e0eb97426 SHA-256: 9a2db567b018920d31b32b332f34040fa8bad06cbbb0aa812c47935150d91c40
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' indicates the document contains a large number of external links, specifically pointing to other PDF files hosted on various domains. The document body, though partially corrupted, contains text related to an exam answer key, suggesting a lure to trick users into downloading further malicious content. The primary attack pattern involves a link farm designed to distribute malicious PDF files.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bcmediaphotographydesign.weebly.com/uploads/1/3/0/3/130324119/vinupuni.pdf In PDF document text
    • http://nowandzenpet.com/uploads/1/3/0/2/130289352/4421859.pdfIn PDF document text
    • http://ncjoyofgarlic.com/uploads/1/3/0/5/130589094/tikus-jigivolik-gelamejipobuzeg.pdfIn PDF document text
    • http://zag.xs-motors.pro/uploads/2020/01/27/kebuxifupotuzub.pdfIn PDF document text
    • http://limestonepantry.ca/uploads/1/3/0/2/130291471/f60c23fbc7f.pdfIn PDF document text
    • http://diamondbabygems.com/uploads/1/3/0/4/130488195/9496410.pdfIn PDF document text
    • http://advanceproductservices.com/uploads/1/3/0/5/130588895/xebefabevo-gadinanutawevo-dobemokubugen-sisekufenina.pdfIn PDF document text
    • http://theheroinesclub.com/uploads/1/3/0/6/130604945/1289225.pdfIn PDF document text
    • http://kbkornhole.com/uploads/1/3/0/3/130313459/4296726.pdfIn PDF document text
    • http://woj.ants-life.ru/uploads/2020/01/28/2381494.pdfIn PDF document text
    • http://danilorojasmendez.tech/uploads/2020/01/28/32ab9e6d.pdfIn PDF document text
    • http://bewear2kxtensions.org/uploads/1/3/0/5/130590716/mefez.pdfIn PDF document text
    • http://myrolemodel.info/uploads/1/3/0/6/130604040/komebelawajire.pdfIn PDF document text
    • http://daveict.com/uploads/1/3/0/5/130550846/kafetefelagelevar.pdfIn PDF document text
    • http://borado.healthmonitoring.tech/uploads/2020/01/28/5640186.pdfIn PDF document text
    • http://knoxvilleangels.org/uploads/1/3/0/3/130313161/2425070.pdfIn PDF document text
    • http://atozadventures.co.uk/uploads/1/3/0/5/130544539/8596524.pdfIn PDF document text
    • http://support-account.net/uploads/2020/01/29/sinilaxunad.pdfIn PDF document text
    • http://wakeforestfarmersmarket.com/uploads/1/3/0/5/130540525/7681442.pdfIn PDF document text
    • http://bakidep.ekzolocin-ot-gribka.pro/uploads/2020/01/28/wepesogupo.pdfIn PDF document text
    • http://nanba-ryu.com/uploads/1/3/0/5/130546333/1992178.pdfIn PDF document text
    • http://seditivu.ssberprizee.info/uploads/2020/01/27/wetozo_dugubibowela.pdfIn PDF document text
    • http://pabuzufeko.caverna.info/uploads/2020/01/28/2685562.pdfIn PDF document text
    • http://myracare.de/uploads/1/3/0/5/130588531/8241220.pdfIn PDF document text
    • http://mysaddlefitter.net/uploads/1/3/0/5/130588799/130588799.html#cdpo+exam+maharashtra+2018+answer+keyIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
🗂 Part of campaign: danilorojasmendez.tech 3 samples

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001736.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1736 8088 bytes
SHA-256: 28dac4f17948dcf34abca2e5a96ca0ee01f7163b3fabcbfe9078ca7c21da9a95
font_01_sfnt_off000071a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x71A7 8336 bytes
SHA-256: 5aca586b07654f11433de7be2811397b52dd92532cb7c16a4f4a24776a986792

Open this report in the interactive analyzer, or submit your own file for analysis.