Malicious PDF — malware analysis report

Static analysis result for SHA-256 a096a44bb0f2a297…

MALICIOUS

PDF

44.5 KB Authoring application: PDFedit First seen: 2020-09-24
MD5: c0b8ac3ff88842ca27c05888342bcd73 SHA-1: b1ab7eebbb0642a11d18efb6bfe6612dfaffee73 SHA-256: a096a44bb0f2a29707a16bf216e49326cc3e8bfbeb93a2e7b94e0648e55347ea
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics, including a critical alert for a link farm and ClamAV detection as phishing malware. The document contains a large number of embedded URLs pointing to other PDF files, suggesting a phishing or redirection campaign. No scripts were extracted from this sample, and the document body contained mostly garbage data.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.revivalsoundstudios.com/uploads/1/3/0/5/130551206/fuxowapinaxegu-redevenobeluti-niteb.pdf In PDF document text
    • http://themarkstaging.com/uploads/1/3/0/7/130740573/09937f6c46b939.pdfIn PDF document text
    • http://mooredems.com/uploads/1/3/0/6/130620834/podibusiso_wafex_rejusekuwalixo_wimubixutas.pdfIn PDF document text
    • http://www.firefallministries.net/uploads/1/3/0/2/130289652/e44e26e8.pdfIn PDF document text
    • http://mallard.financial/uploads/1/3/0/3/130323322/a22e64cdebc51c2.pdfIn PDF document text
    • http://tampadivorcehelp.com/uploads/1/3/0/8/130874204/20e9e0.pdfIn PDF document text
    • http://argamaprints.com/uploads/1/3/0/5/130541688/9d982e9.pdfIn PDF document text
    • http://brooksfirth.com/uploads/1/3/0/7/130774966/bewufaxareginewupa.pdfIn PDF document text
    • http://thewreckingcru.com/uploads/1/3/0/6/130621868/luzipagamebu-raxosopudaw-nanavotijap-zelumax.pdfIn PDF document text
    • http://southamericasflowers.com/uploads/1/3/0/7/130738646/4336712.pdfIn PDF document text
    • http://femalefinancialindependence.com/uploads/1/3/0/7/130738885/3a86b4c1695b1.pdfIn PDF document text
    • http://amomilanoleather.com/uploads/1/3/0/4/130483759/6589314.pdfIn PDF document text
    • http://thisisgood.org/uploads/1/3/0/6/130621048/lenoper.pdfIn PDF document text
    • http://mobyzap.com/uploads/1/3/0/6/130639552/faa3a9.pdfIn PDF document text
    • http://mail.jaynestringer.com/uploads/1/3/0/8/130874218/zugilimitopus.pdfIn PDF document text
    • http://schallisflyfishing.de/uploads/1/3/0/8/130814343/4897098.pdfIn PDF document text
    • http://nationalautomobilemuseum.org/uploads/1/3/0/6/130639309/digodavunoraxe.pdfIn PDF document text
    • http://georgebeaumont.com/uploads/1/3/0/7/130775786/709acf7.pdfIn PDF document text
    • http://destinationsoflove.voyagerwebsites.com/uploads/1/3/0/5/130588390/130588390.html#passive+voice+of+past+perfect+tense+in+hindiIn PDF document text
    • http://fedorahosted.org/lohitIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c58.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C58 1388 bytes
SHA-256: 1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0
font_01_sfnt_off00003465.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3465 9876 bytes
SHA-256: bcde61ecd45420224a88d1b06c71554ae2804ab9cf05accec13587861c4beb7e
font_02_sfnt_off00005083.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5083 7624 bytes
SHA-256: 909fa321cc843951641c7dde2042f3ec4a990de3a7e0ae8af166c6cebacb3728

Open this report in the interactive analyzer, or submit your own file for analysis.