Malicious PDF — malware analysis report

Static analysis result for SHA-256 ac0dcb8aef1385ef…

MALICIOUS

PDF

37.6 KB Authoring application: Smallpdf Desktop First seen: 2020-09-07
MD5: 01327c66eec808043adb3c3b59fb672f SHA-1: dbdc3b41edfe6dcd11a0c01fc5184ee5b47e2a9e SHA-256: ac0dcb8aef1385eff1a15787bb50ba07601d82adc5193f0f5dc85e2c9977470a
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links to other PDFs, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the presence of embedded URLs strongly suggest a phishing or malware distribution campaign. The document body, though heavily corrupted, contains phrases related to PDF software, likely a lure to encourage downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hardwarebridge.com/uploads/1/3/0/8/130813859/dolik.pdf In PDF document text
    • http://scottgieser.com/uploads/1/3/0/5/130589094/378bd6e3d.pdfIn PDF document text
    • http://myescondidosoccer.com/uploads/1/3/0/2/130287513/lirasejot.pdfIn PDF document text
    • http://sg.camisashabers.com.mx/uploads/1/3/0/6/130621607/98b82f.pdfIn PDF document text
    • http://robyntapley.com/uploads/1/3/0/4/130488732/nikexogerinatuj.pdfIn PDF document text
    • http://weworkdistributed.life/uploads/1/3/0/5/130550704/c28c5740.pdfIn PDF document text
    • http://www.thesoundofthecoldwar.com/uploads/1/3/0/3/130313414/xofuki.pdfIn PDF document text
    • http://daviddcal.com/uploads/1/3/0/5/130590363/6041614.pdfIn PDF document text
    • http://nashobaspeechandfeeding.net/uploads/1/3/0/2/130270747/223499.pdfIn PDF document text
    • http://a-custom-esl-tutoring.com/uploads/1/3/0/6/130640163/4547123.pdfIn PDF document text
    • http://beginningphpandmysql.com/uploads/1/3/0/7/130740389/3dbc27a98827e12.pdfIn PDF document text
    • http://quorp.com/uploads/1/3/0/5/130541103/5b54bc798541b3.pdfIn PDF document text
    • http://0negocios.biz/uploads/1/3/0/6/130639110/59c6b1cb1a1.pdfIn PDF document text
    • http://sthfromnth.com/uploads/1/3/0/6/130620337/lonidosumuvejadevos.pdfIn PDF document text
    • http://keithharleystyle.com/uploads/1/3/0/7/130740590/92979cf0020c865.pdfIn PDF document text
    • http://digital-chicago.org/uploads/1/3/0/4/130476309/dekipiwor.pdfIn PDF document text
    • http://anongroup.org/uploads/1/3/0/2/130288565/3265445.pdfIn PDF document text
    • http://firebirdpoker.com/uploads/1/3/0/5/130589033/0765a9ddd4050.pdfIn PDF document text
    • http://transportedepianosymudanza.com/uploads/1/3/0/6/130639994/9699402.pdfIn PDF document text
    • http://benton-jp.com/uploads/1/3/0/5/130589316/f5e215e.pdfIn PDF document text
    • http://nestednotebooks.org/uploads/1/3/0/7/130739088/e081abd61d.pdfIn PDF document text
    • http://granhotelmonterrey-es.devsite-1.com/uploads/1/3/0/4/130488273/130488273.html#free+download+pdf+reader+software+for+windows+7In PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000315c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x315C 8244 bytes
SHA-256: c84f8f63ca5bff7507aefbb39e25e2118754b856f33d9e472a15bee5f8e95065

Open this report in the interactive analyzer, or submit your own file for analysis.