Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2ad5ab297155a33…

MALICIOUS

PDF

39.5 KB Authoring application: Inkscape First seen: 2020-09-24
MD5: a2a6d78ad044e3dbec4fd1e580c39031 SHA-1: 46a9c41c0ac4a9fe6d95340804ebe39907b3205c SHA-256: a2ad5ab297155a33856867867d969688cdc2b635601a5adef27807a81f75abc4
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded URLs pointing to other PDF files, indicating a link farm designed to lure users into downloading malicious content. The heuristic 'PDF_SEO_LINK_FARM' and ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggest a phishing or malware distribution campaign. The document body, though partially corrupted, also contains several of these malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://simpleups.com/uploads/1/3/0/6/130621290/xarafamud_titudimivekabaz_gedumejafiwexar_nawuluweranot.pdf In PDF document text
    • http://autoshredder.net/uploads/1/3/0/8/130874143/3236902.pdfIn PDF document text
    • http://www.swap-party.org/uploads/1/3/0/7/130776072/e4d741fcb57dc.pdfIn PDF document text
    • http://kristonjackson.com/uploads/1/3/0/7/130739446/jipifisefib.pdfIn PDF document text
    • http://biggerpicture.shop/uploads/1/3/0/7/130776847/poxepimeloku_doniz.pdfIn PDF document text
    • http://pizl.com/uploads/1/3/0/7/130740264/vugijowa-vogelubeju.pdfIn PDF document text
    • http://webmail.ressourcetherapie.com/uploads/1/3/0/4/130483276/5b7c5eff30627a.pdfIn PDF document text
    • http://moversinmiami.net/uploads/1/3/0/5/130542780/wotepor.pdfIn PDF document text
    • http://danvillesanramonpainter.com/uploads/1/3/0/5/130588556/teguvupamef.pdfIn PDF document text
    • http://teamborkowski.com/uploads/1/3/0/7/130776647/bejoriditopi_sotixodutatak_gijop.pdfIn PDF document text
    • http://tdf20years.com/uploads/1/3/0/6/130640144/pizumezurimifudixuw.pdfIn PDF document text
    • http://josiebryant.com/uploads/1/3/0/7/130739786/2685458.pdfIn PDF document text
    • http://waawaafarm.com/uploads/1/3/0/9/130969184/wametozesino.pdfIn PDF document text
    • http://eastbaypsychotherapycollaborative.org/uploads/1/3/0/6/130621446/vileliw.pdfIn PDF document text
    • http://talismancreativementoring.com/uploads/1/3/0/6/130621043/2578338.pdfIn PDF document text
    • http://melogerneuf.com/uploads/1/3/0/5/130551890/5421040.pdfIn PDF document text
    • http://whosyourhoosier.com/uploads/1/3/0/6/130620670/ece3395e9d42.pdfIn PDF document text
    • http://bardercreative.com/uploads/1/3/0/4/130435544/06575e1ff.pdfIn PDF document text
    • http://bwhousein.com/uploads/1/3/0/6/130621465/8949290.pdfIn PDF document text
    • http://swcfamilyretreats.com/uploads/1/3/0/4/130493143/vukatuderazuwobu.pdfIn PDF document text
    • http://4n0.com/uploads/1/3/0/6/130639634/nugepawiwoden.pdfIn PDF document text
    • http://9roundmemphis.com/uploads/1/3/0/3/130313224/legoru.pdfIn PDF document text
    • http://pitchthefork.net/uploads/1/3/0/5/130539182/levebile-wedifemud-buzejudura-totova.pdfIn PDF document text
    • http://thin56.pleasingfood.com/uploads/1/3/0/9/130969684/130969684.html#online+multiple+page+pdf+converterIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003665.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3665 8472 bytes
SHA-256: 64227c6de92b991ec3aabe911f13bc00aa54657265e38d00391b8dd7d790b9ee

Open this report in the interactive analyzer, or submit your own file for analysis.