Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b2cc67c95dcb4cf…

MALICIOUS

PDF

49.1 KB Authoring application: Smallpdf Desktop First seen: 2020-09-07
MD5: 7081267cb09c574453edd7e2b4528d7e SHA-1: ea42d9e6559549f604169cc7cee3a45805452100 SHA-256: 9b2cc67c95dcb4cf35b3381cc4cab0e4e112c5dd89528b6140f0fb01a16726d5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious distribution intent. The document body appears to be corrupted or truncated, preventing a more detailed analysis of its specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sesacademy.org/uploads/1/3/0/6/130620478/7732391.pdf In PDF document text
    • http://giresungiyim.com/uploads/1/3/0/5/130539021/69889286bcb5.pdfIn PDF document text
    • http://oroi.biz/uploads/1/3/0/7/130775472/8569333.pdfIn PDF document text
    • http://thisismylifesong.org/uploads/1/3/0/6/130604227/dcca9f5.pdfIn PDF document text
    • http://www.audacast.com/uploads/1/3/0/3/130323213/jatudisunok.pdfIn PDF document text
    • http://dvmlibrary.com/uploads/1/3/0/6/130605373/lariwa.pdfIn PDF document text
    • http://thesimplechristian.com/uploads/1/3/0/6/130639241/lugamix_bugorutowi_bidutufezenivi_limabulib.pdfIn PDF document text
    • http://rusewood.net/uploads/1/3/0/2/130289211/ec5017938b.pdfIn PDF document text
    • http://sydneyft.com/uploads/1/3/0/3/130379522/papaxinedapuwo.pdfIn PDF document text
    • http://ballerweekly.com/uploads/1/3/0/6/130621495/2307321.pdfIn PDF document text
    • http://sonopadronedellamiavita.org/uploads/1/3/0/2/130271131/9607924.pdfIn PDF document text
    • http://nunavikyouthhouseassociation.com/uploads/1/3/0/4/130477152/5760592.pdfIn PDF document text
    • http://myerstownboyscouts.com/uploads/1/3/0/5/130538939/1c7ce.pdfIn PDF document text
    • http://propertypix.org/uploads/1/3/0/6/130605443/a2d2a245.pdfIn PDF document text
    • http://zwickenterprises.com/uploads/1/3/0/5/130550895/433356.pdfIn PDF document text
    • http://ormansite.com/uploads/1/3/0/7/130739212/nunotuxigifepet.pdfIn PDF document text
    • http://christinahankinsart.com/uploads/1/3/0/4/130483552/9650523e69831d.pdfIn PDF document text
    • http://www.lowetruckingworld.com/uploads/1/3/0/2/130287495/2f943e91d48cd.pdfIn PDF document text
    • http://www.12dtech.com/uploads/1/3/0/6/130639995/ninewujeterefaxos.pdfIn PDF document text
    • http://www.fitvibeswithangie.com/uploads/1/3/0/6/130620490/9aaad3b.pdfIn PDF document text
    • http://marianoelide.com/uploads/1/3/0/2/130288684/02df506f16.pdfIn PDF document text
    • http://insicknessandinhealth.info/uploads/1/3/0/6/130621261/razipow.pdfIn PDF document text
    • http://amlanordstages.com/uploads/1/3/0/3/130379482/2324948.pdfIn PDF document text
    • http://webmail.jhigh18.com/uploads/1/3/0/6/130639687/130639687.html#scones+recipe+with+olive+oilIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003859.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3859 16248 bytes
SHA-256: b195ba776360337e0c8847a1f70ebf7e776628c0b6b62df72d82cae76b96cbf1
font_01_sfnt_off00004d75.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4D75 2732 bytes
SHA-256: 50224c6c483bfa86a10f62efd7baa2c756f8036c0a911ebd537387e21b2fb6f3
font_02_sfnt_off000059f1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x59F1 9260 bytes
SHA-256: 693b843a16dfc39c8759a73eb32b73e8b017ad0c2dd670768c480523ab484ea5

Open this report in the interactive analyzer, or submit your own file for analysis.