Malicious PDF — malware analysis report

Static analysis result for SHA-256 b13aa2e512e1ebbd…

MALICIOUS

PDF

121.9 KB Authoring application: Solid Converter PDF First seen: 2020-09-24
MD5: e065c99d553cb15532116912e9f9b2b1 SHA-1: 07d84934cd74145e7d2c77bba239473af5074e76 SHA-256: b13aa2e512e1ebbdd4489f04d12058bcd42228a7cc045d2913b18cf4d9854718
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The SE_LOLBIN_RUN_COMMAND heuristic indicates the presence of instructions that likely involve Windows execution tools. The ClamAV detection further confirms its malicious nature, classifying it as Pdf.Phishing.TtraffRobotInstall. The primary attack pattern involves directing users to a vast network of external PDF files, potentially for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • LOLBin token sequence in document text high SE_LOLBIN_RUN_COMMAND
    Extracted document text contains a Windows script/execution tool name (PowerShell, mshta, cmd, rundll32, regsvr32, …) within 220 characters of a dangerous flag, command verb, or URL. This is a visible 'run this' instruction in HTML/PDF/RTF lure bodies, or — in macro-laden Office files — the macro's own string-pool entries appearing adjacent in extracted text.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.nova-distribution.eu/uploads/1/3/0/9/130969200/1857947.pdf In PDF document text
    • http://preparedmealstogo.com/uploads/1/3/0/6/130621895/sexakezurab.pdfIn macro / runtime command snippet
    • http://learnmormonfacts.com/uploads/1/3/0/7/130738715/7d5427f6eb.pdfIn PDF document text
    • http://karimlemec.it/uploads/1/3/0/6/130620412/jasuzofixiva.pdfIn PDF document text
    • http://pyrowinecellars.com/uploads/1/3/0/4/130483795/4190410.pdfIn PDF document text
    • http://blockchain.security/uploads/1/3/0/6/130620478/55d0e2e4359d6.pdfIn PDF document text
    • http://desertmountainrental.com/uploads/1/3/0/7/130739907/pelogowuwugizo.pdfIn PDF document text
    • http://semeionmarketing.com/uploads/1/3/0/8/130814423/ddf25640c57.pdfIn PDF document text
    • http://phoenixtech.biz/uploads/1/3/0/2/130289649/3afe363f0872.pdfIn PDF document text
    • http://hottcoffee.live/uploads/1/3/0/2/130291493/a047adebf.pdfIn PDF document text
    • http://noreenhughes.com/uploads/1/3/0/4/130435943/lejajufidem-tipisamojux-zumubavabu.pdfIn PDF document text
    • http://taradaav.com/uploads/1/3/0/6/130604034/zaxoge.pdfIn PDF document text
    • http://makingmusicmodular.com/uploads/1/3/0/6/130603932/jexidok.pdfIn PDF document text
    • http://monolithcomputing.com/uploads/1/3/0/2/130291585/lelumad.pdfIn PDF document text
    • http://kerrylindner.net/uploads/1/3/0/2/130272083/dc0fb044bd4.pdfIn PDF document text
    • http://linden58.pleasingfood.com/uploads/1/3/0/5/130551562/130551562.html#seizure+symptoms+wikipediaIn PDF document text
    • http://www.nova-In macro / runtime command snippet
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c72.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2C72 9536 bytes
SHA-256: 868aac0057515e358d9c0e87e72090abdb83c02b60295eb9d9dd277d5a056a04
font_01_sfnt_off0000fd33.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFD33 5456 bytes
SHA-256: 66228b287bfafcabfbc68a35f1a3341d2566c84f3f64b6372cca4f6b2550dbe8
font_02_sfnt_off00010d2c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x10D2C 16580 bytes
SHA-256: c81131162d985c9d28dd86c513b25fb75191b2b8272011354c9e8f2db2c42fab

Open this report in the interactive analyzer, or submit your own file for analysis.