Malicious PDF — malware analysis report

Static analysis result for SHA-256 ad232158bced3806…

MALICIOUS

PDF

70.7 KB Authoring application: SWFTools First seen: 2020-09-24
MD5: 59f334a39fe52d9da803fd07960453ad SHA-1: 4eb1519c1b63b65c792179c67d2880344ee3057b SHA-256: ad232158bced3806cd5ab55c22123e7e5c076ed0da2705a4d6fd6f5114e7f62e
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded external links, many of which point to other PDF files. This behavior is indicative of a link farm designed to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious classification. The document body, though heavily obfuscated, contains a list of URLs that are likely part of this distribution network.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://radiantlifeacademy.org/uploads/1/3/0/6/130639547/a90dbe57eb8b98.pdf In PDF document text
    • http://zokixese.0406shopps01.fun/uploads/2020/01/29/vosevikil-nowuneru.pdfIn PDF document text
    • https://kawizugewel.weebly.com/uploads/1/3/0/5/130541188/0a377a255.pdfIn PDF document text
    • http://paypass.pro/uploads/2020/01/28/86baa75.pdfIn PDF document text
    • http://kirurofexu.firstcommonsense.com/uploads/2020/01/27/lomefoxu-savapumowi-kanepoxudasuze.pdfIn PDF document text
    • http://tayadsy.tech/uploads/2020/01/27/gesibunivefugi.pdfIn PDF document text
    • https://pokizizefavef.weebly.com/uploads/1/3/0/5/130588477/3716943.pdfIn PDF document text
    • http://rooflocators.com/uploads/1/3/0/5/130551777/8344037.pdfIn PDF document text
    • http://sovod.molodostbz.club/uploads/2020/01/28/492373defc65.pdfIn PDF document text
    • https://rozegotaxot.weebly.com/uploads/1/3/0/4/130436318/1131535.pdfIn PDF document text
    • http://nourishmarket.ca/uploads/1/3/0/5/130588964/nadowid_gebid_vefurivi_xiforope.pdfIn PDF document text
    • http://rukireg.yukariyorum.org/uploads/2020/01/27/wipetoronanolagiref.pdfIn PDF document text
    • http://rightofwaysolutionsllc.com/uploads/1/3/0/6/130620317/1966b0257b72a0.pdfIn PDF document text
    • https://vuwizosub.weebly.com/uploads/1/3/0/2/130287238/5118856.pdfIn PDF document text
    • http://motebe.myshop8.site/uploads/2020/01/28/d8d96fadd17646.pdfIn PDF document text
    • https://nizikivinagunel.weebly.com/uploads/1/3/0/3/130379291/7793094.pdfIn PDF document text
    • http://whatthefunkdenver.com/uploads/1/3/0/5/130539642/6208975.pdfIn PDF document text
    • http://mgkindergarten.weebly.com/uploads/1/3/0/6/130639329/mamemi-bigef.pdfIn PDF document text
    • http://mrsrcmath.weebly.com/uploads/1/3/0/3/130323522/tadaganad_jixemuvapipalu_rakubed_gejuzef.pdfIn PDF document text
    • http://migorakuso.kamera360.ru/uploads/2020/01/27/1064290.pdfIn PDF document text
    • http://thereadingrumpusroom.com/uploads/1/3/0/4/130476485/6698877.pdfIn PDF document text
    • http://nvspconiond7o3soonion.pw/uploads/2020/01/28/xapujeru.pdfIn PDF document text
    • http://vum.paulcotyantiques.com/uploads/2020/01/28/wolarobazasojug_jepatujuli_xewiguro.pdfIn PDF document text
    • http://stmarysautorepairandsales.com/uploads/1/3/0/4/130478067/130478067.html#wow+engineering+guideIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017f0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17F0 8396 bytes
SHA-256: 2b39233718cc40753d96c76702e94c1de981ea6de5de548bf952cbffd75ef56f
font_01_sfnt_off00006004.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6004 16068 bytes
SHA-256: 6db2f878e0fd57d3a351d0d81a5ccd7b58f68df6728dadc3aee3ebeb1a1d6e60

Open this report in the interactive analyzer, or submit your own file for analysis.