Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6858a3c97f8c179…

MALICIOUS

PDF

34.1 KB Authoring application: Pdftk First seen: 2020-09-24
MD5: ab05a2e44ea222cf9ba2d91100dd75d0 SHA-1: d77ca982f01ee54146001667c5dac71a4bedcaf8 SHA-256: a6858a3c97f8c17914d641c232b9f97a018e1200a45ba163f082973c472675ea
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0 and a machine learning classifier. The PDF contains a large number of embedded URLs, indicating a link farm designed to redirect users to potentially malicious content. The primary heuristic firing, PDF_SEO_LINK_FARM, confirms this behavior, with the dominant host being suntuffnatives.com.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://suntuffnatives.com/uploads/1/3/0/6/130604772/5ffd834e.pdf In PDF document text
    • http://www.whatsyoureroticblueprint.com/uploads/1/3/0/4/130490461/61afa2f3be.pdfIn PDF document text
    • http://dustbuster.us/uploads/1/3/0/5/130541402/9125182.pdfIn PDF document text
    • http://mrspsela.com/uploads/1/3/0/5/130551302/dufob-raxatopa-narofegiji.pdfIn PDF document text
    • http://www.labella1boutique.com/uploads/1/3/0/5/130551423/gunilifajafavid.pdfIn PDF document text
    • http://gabrielledrouin.com/uploads/1/3/0/7/130775126/kodiritik_fokisol_gutilozuzipu_xerut.pdfIn PDF document text
    • http://quadgear.org/uploads/1/3/0/8/130813417/aae69fc1eebfd.pdfIn PDF document text
    • http://www.rateyourinterviews.com/uploads/1/3/0/7/130775215/xidevawivol.pdfIn PDF document text
    • http://ninefortyfilms.com/uploads/1/3/0/6/130621785/467ad.pdfIn PDF document text
    • http://www.amphiby.com/uploads/1/3/0/6/130621480/sitisaxiwaz-fasodafoweku.pdfIn PDF document text
    • http://www.regalshowcase.com/uploads/1/3/0/3/130313410/ad55e34.pdfIn PDF document text
    • http://carroattrezziusati.com/uploads/1/3/0/5/130588594/af03b.pdfIn PDF document text
    • http://spd-bremen-stadt.com/uploads/1/3/0/4/130436017/d296a6e8a4.pdfIn PDF document text
    • http://newyorkwinelaw.com/uploads/1/3/0/6/130604538/d6686.pdfIn PDF document text
    • http://fancher-sisters.rominastiebenphotography.com/uploads/1/3/0/4/130488415/130488415.html#nitric+acid+msds+sigma+pdfIn PDF document text
🗂 Part of campaign: ninefortyfilms.com 4 samples

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002a5d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2A5D 8252 bytes
SHA-256: 3715872d014a9825d2b0af483adb3d94d94826f4978a8e2090aea2fad4a9573c

Open this report in the interactive analyzer, or submit your own file for analysis.