Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7fe247e1abbaae9…

MALICIOUS

PDF

132.5 KB Authoring application: PDFBox First seen: 2020-09-24
MD5: 533d0c199347c221f730ee549c57a816 SHA-1: ded10890a87cee769efe923c2d9b8f8951cca5bb SHA-256: b7fe247e1abbaae9cbe19d0d50076bf3647ec277e658617a4056a8eecd7d7e1c
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF document employs an advance-fee scam lure, presenting a fake parcel delivery notification to entice users to click on numerous embedded links. The document contains a link farm, with the primary domain being 'miquelroig.com'. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports its malicious classification as a phishing document.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9981

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://miquelroig.com/uploads/1/3/0/4/130436007/zemibidirav.pdf In PDF document text
    • http://forestavenuemedical.com/uploads/1/3/0/7/130740538/wakuvofolakapubu.pdfIn PDF document text
    • http://arty-lab.com/uploads/1/3/0/2/130271177/53d2a0c3867c.pdfIn PDF document text
    • http://ravisatyakahn.com/uploads/1/3/0/6/130605420/7754186.pdfIn PDF document text
    • http://mitchellwenkus.com/uploads/1/3/0/5/130538959/xirezamokemo.pdfIn PDF document text
    • http://whiskeyvegan.com/uploads/1/3/0/7/130738719/zenekavil-boxixubikago.pdfIn PDF document text
    • http://nounoula.com/uploads/1/3/0/7/130775363/9db63176514.pdfIn PDF document text
    • http://arkiv.rokus.no/uploads/1/3/0/6/130620635/9432441.pdfIn PDF document text
    • http://miv.mezoter.ru/uploads/2020/01/28/1804465.pdfIn PDF document text
    • http://1169certified.info/uploads/1/3/0/2/130274371/613a6556d26523.pdfIn PDF document text
    • http://fakubigo.xelamit.ru/uploads/2020/01/29/nomuwigidimugafad.pdfIn PDF document text
    • https://renepemo.weebly.com/uploads/1/3/0/2/130289774/vusurefi.pdfIn PDF document text
    • http://sauerlandhypotheek.nl/uploads/1/3/0/4/130475955/130475955.html#acc%2Faha+heart+failure+guidelines+2013+pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012d8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12D8 8820 bytes
SHA-256: eff6bee0aa245838812126a656210669144a1f20b2bfc77f8326bdf8ba0527e4
font_01_sfnt_off0000a7ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xA7BA 16040 bytes
SHA-256: 2959476c5f94eab6b6b2ffd9cf8eddac6ccb1c6c7aee9290b1d2b651b3211ebd

Open this report in the interactive analyzer, or submit your own file for analysis.