Malicious PDF — malware analysis report

Static analysis result for SHA-256 af2337702f49ce89…

MALICIOUS

PDF

46.6 KB Authoring application: QPDF First seen: 2020-09-15
MD5: 0c95e96bca6735944402fd5aad70d849 SHA-1: 7685c01358846b1120d3240eecc0619b8137409c SHA-256: af2337702f49ce89659b97b68ce7df2b133ee6379b14b129bff70e2a6b95a47b
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links, many of which point to other PDF files hosted on various domains, indicating a link farm for SEO or malicious redirection. ClamAV identified the file as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a machine learning classifier also flagged it as malicious. The document body, though heavily obfuscated, contains references to software and URLs, suggesting a lure to download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://neroliltd.com/uploads/1/3/0/7/130740492/9fd73e453b7fb.pdf In PDF document text
    • http://sarahrileypottery.com/uploads/1/3/0/4/130493714/nezisolusu-japipape.pdfIn PDF document text
    • http://missmillersclassroom.com/uploads/1/3/0/5/130545254/nusobe.pdfIn PDF document text
    • http://premierbeachpropertymanagement.com/uploads/1/3/0/4/130483477/ad44f622558.pdfIn PDF document text
    • http://courageblogs.com/uploads/1/3/0/6/130604363/3791578.pdfIn PDF document text
    • https://nivelimobe.weebly.com/uploads/1/3/0/3/130313612/zubepe.pdfIn PDF document text
    • http://mikeintucson.com/uploads/1/3/0/4/130491179/130491179.html#bartender+barcode+fullIn PDF document text
    • http://linux.thai.net/projects/fonts-tlwgIn PDF document text
    • http://www.thaitux.infoIn PDF document text
🗂 Part of campaign: biztriage.com 8 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010fb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10FB 8708 bytes
SHA-256: 9276ae18d6a236dee1e981b5b172de1fd072ad0f13dcb348480ba1821fe8366d
font_01_sfnt_off000064ee.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x64EE 14440 bytes
SHA-256: 89cffd49cf4750360b48b4fe2269b7dba9def12e76d8034fb78fc8b51d0e4c24

Open this report in the interactive analyzer, or submit your own file for analysis.