Malicious PDF — malware analysis report

Static analysis result for SHA-256 b45005d69a489c37…

MALICIOUS

PDF

58.0 KB Authoring application: PDF Studio First seen: 2020-09-24
MD5: 743f7d37afdd2831afcc03ec4e7d0fde SHA-1: bc695130e83eb900202817bb3c8cda41166cc0ac SHA-256: b45005d69a489c374775e6dd3c02ceb5fefb4f255278653ba3b7c051e8a2773f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file exhibits a critical heuristic firing for a link farm, containing numerous embedded URLs. These URLs likely serve as lures for phishing attacks or to distribute further malware. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and traffic redirection intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://merakihealing.org/uploads/1/3/0/2/130289158/ea7f87.pdf In PDF document text
    • http://perfectlg.org/uploads/1/3/0/2/130272909/1199679.pdfIn PDF document text
    • http://hannah-swain.com/uploads/1/3/0/6/130604639/8177998.pdfIn PDF document text
    • http://ccrpal.org/uploads/1/3/0/5/130538840/pefutinodez_zotoniga.pdfIn PDF document text
    • http://dahvik.com/uploads/1/3/0/4/130483866/sirelomadufi.pdfIn PDF document text
    • http://3dactivesports.com/uploads/1/3/0/6/130603772/1193463.pdfIn PDF document text
    • http://jennyoakley.com/uploads/1/3/0/7/130775259/9a4dcc6a.pdfIn PDF document text
    • http://flyingquest.com/uploads/1/3/0/2/130289711/6924063.pdfIn PDF document text
    • http://doctor-melanie.com/uploads/1/3/0/5/130544734/4281596.pdfIn PDF document text
    • http://1169certified.info/uploads/1/3/0/2/130289308/jisevi-kuwefoxe-nimuge-vazemedeta.pdfIn PDF document text
    • http://4burlingtonwoods.com/uploads/1/3/0/5/130539102/salugu_kabexigenujo_raweduzuv_ralenapi.pdfIn PDF document text
    • http://jeanstandmeministries.com/uploads/1/3/0/5/130547576/pelezitafega-pirol.pdfIn PDF document text
    • http://bodyworkbybarb.com/uploads/1/3/0/8/130814219/130814219.html#sda+primary+sabbath+schoolIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fe5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xFE5 8820 bytes
SHA-256: 43a0725696931e88fe25038c0c31e76ec11135399d71d8d997425d93c9435ded
font_01_sfnt_off00009d0b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9D0B 16092 bytes
SHA-256: 8e79e6f40449bce11010868496ff806dc7d5faab648b4a9baf63b9dd17e2b45d

Open this report in the interactive analyzer, or submit your own file for analysis.