Malicious PDF — malware analysis report

Static analysis result for SHA-256 9d624a6c83a8cad3…

MALICIOUS

PDF

42.0 KB Authoring application: Solid Converter PDF First seen: 2020-09-07
MD5: 2ba5396c33cfff84681ee47a4a207c0d SHA-1: f52a0eafaf511983412b4cd6d9e07d19bc154314 SHA-256: 9d624a6c83a8cad354bb3adb75c50fb9815201cceee0da6f43bf253581cec6ae
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF file was flagged by multiple heuristics, including a critical finding for a link farm and a ClamAV detection for phishing. The ML classifier also strongly indicated maliciousness. The document body contains a reference to a brake caliper guide pin thread repair kit, which appears to be a lure. The primary attack pattern involves directing users to a large number of external PDF files hosted on various domains, likely for SEO manipulation or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fanadelonilavo.weebly.com/uploads/1/3/0/3/130313641/pobuxi.pdf In PDF document text
    • http://sflat.net/uploads/1/3/0/2/130271154/getoxe.pdfIn PDF document text
    • http://comonativo.com/uploads/1/3/0/6/130603748/ziwukaten.pdfIn PDF document text
    • http://votepedrini.com/uploads/1/3/0/4/130478709/fumanatiwes.pdfIn PDF document text
    • http://imperiya.top/uploads/2020/01/28/rezerisiw-zujiv-rodoxegujuruluf.pdfIn PDF document text
    • http://boylepublichealth.com/uploads/1/3/0/2/130287426/paline_gugaran.pdfIn PDF document text
    • http://missannamariebarrios.site/uploads/2020/01/29/9465792.pdfIn PDF document text
    • http://beantownscience.com/uploads/1/3/0/5/130541924/7333023.pdfIn PDF document text
    • http://bienvenufosterryanobannonlawllc.com/uploads/1/3/0/3/130324075/lupixoke_nokuzomopo.pdfIn PDF document text
    • http://tedramillan.com/uploads/1/3/0/6/130605173/kisugetoberogikilu.pdfIn PDF document text
    • https://majizaponejodoj.weebly.com/uploads/1/3/0/3/130313513/guburunejapusag_rimogowa.pdfIn PDF document text
    • http://semprav.ru/uploads/2020/01/28/417eae.pdfIn PDF document text
    • http://vipschoolofcosmetology.com/uploads/1/3/0/3/130313218/1019938.pdfIn PDF document text
    • http://zambiasafarihunting.com/uploads/1/3/0/2/130272233/nulefa_jexiluj.pdfIn PDF document text
    • http://plumbingleakprotection.com/uploads/1/3/0/6/130621060/c823f6e5d3928c1.pdfIn PDF document text
    • https://fogojozalixa.weebly.com/uploads/1/3/0/3/130313021/vodani.pdfIn PDF document text
    • http://duza.zhenskiedni.ru/uploads/2020/01/28/neguwipidovopokuf.pdfIn PDF document text
    • https://gebusapokamuger.weebly.com/uploads/1/3/0/4/130435988/dazuzofedejapaj-janarus.pdfIn PDF document text
    • http://zokibelega.jetblue-air.com/uploads/2020/01/27/mofezobu_gerijadegen_fodenekakebofe.pdfIn PDF document text
    • http://middleschoollessons.com/uploads/1/3/0/3/130379575/8459699.pdfIn PDF document text
    • http://disabilitymanagmentsolutions.ca/uploads/1/3/0/5/130550915/gererotutef-zizexamafefil.pdfIn PDF document text
    • http://directinservicetrainingtexas.com/uploads/1/3/0/5/130546415/nokitigizotunid_fomexujifiwogem.pdfIn PDF document text
    • http://nyforceacademy.com/uploads/1/3/0/2/130287976/6444300.pdfIn PDF document text
    • http://addressfox.com/uploads/1/3/0/5/130550789/d0cabae.pdfIn PDF document text
    • http://ankezimmermann.ca/uploads/1/3/0/4/130475981/a53ea071e7.pdfIn PDF document text
    • http://gomriz.com/uploads/1/3/0/6/130640145/130640145.html#brake+caliper+guide+pin+thread+repair+kitIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001807.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1807 8172 bytes
SHA-256: f7992489b338eafd1ad1ecdd60153c50bd6ec818bd8bfc4f5e0127459ec0f6ed
font_01_sfnt_off00005b92.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5B92 16232 bytes
SHA-256: 3974891db8a4ec8ec2d7bd6096109588069a4504a1a2c6a6a63e29e83c6c02e0

Open this report in the interactive analyzer, or submit your own file for analysis.