Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1abacc250472a9c…

MALICIOUS

PDF

51.7 KB Authoring application: pdf-parser First seen: 2020-09-24
MD5: a28e345d710dfb99709994c8e4b5e8fb SHA-1: 71e6dd33516f483b8b2d1e40ad4a80b8ea667ce7 SHA-256: b1abacc250472a9c7ba04e302dc49be63a4b93068859241f503003c98692696b
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, many of which point to other PDF files, suggesting a link farm for SEO or malicious redirection. The document body explicitly mentions changing bank instructions, a common lure for Business Email Compromise (BEC) attacks. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing and traffic redirection intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thewateringcansupply.com/uploads/1/3/0/4/130489001/rezagifalade.pdf In PDF document text
    • http://mermaidtidying.com/uploads/1/3/0/6/130639110/fd44af97a64e14d.pdfIn PDF document text
    • http://eikumpel.com/uploads/1/3/0/3/130313046/894bb5a.pdfIn PDF document text
    • http://jonathanfine.net/uploads/1/3/0/2/130289311/kifagowulapiwibi.pdfIn PDF document text
    • http://ngabwe.com/uploads/1/3/0/2/130289204/jaroxewonodu-wijugifaripat.pdfIn PDF document text
    • http://adamhamdy.net/uploads/1/3/0/2/130289553/zabukalurosatik_pagaxe.pdfIn PDF document text
    • http://stadtentdecker-in.de/uploads/1/3/0/2/130270832/lerarufigep.pdfIn PDF document text
    • http://theempoweredyou.com/uploads/1/3/0/2/130270738/9aa9ff24b801.pdfIn PDF document text
    • https://zuvebafowo.weebly.com/uploads/1/3/0/2/130288762/b88babf086d.pdfIn PDF document text
    • http://nomadicpeople.org/uploads/1/3/0/6/130603916/vilipe.pdfIn PDF document text
    • http://giftsofcreativity.com/uploads/1/3/0/7/130775714/selile_fezulogegixo.pdfIn PDF document text
    • http://arcadiagardensllclandscapinganddesign.com/uploads/1/3/0/6/130620730/130620730.html#how+to+fill+up+sbi+nri+account+opening+form+sampleIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012ea.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12EA 8448 bytes
SHA-256: 18850f89c2944ece9e7f4fa93c7700dac2c676d741dfb2c3597882ee1c1b7b58
font_01_sfnt_off00008079.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8079 9148 bytes
SHA-256: 0d38102ca3d4ee6690098c940813a33f80cb27b1a93d32bf7c7fb5c1fee31760

Open this report in the interactive analyzer, or submit your own file for analysis.