Malicious PDF — malware analysis report

Static analysis result for SHA-256 bd4bf9f9ff994cb7…

MALICIOUS

PDF

42.4 KB Authoring application: PDFedit First seen: 2020-09-24
MD5: 3b82137ac465eca0db6ba29c5ba22ae6 SHA-1: 1d25891c0f0b816d045970863304b78267b578d4 SHA-256: bd4bf9f9ff994cb7723ede71791ae59570e629691c589680e1d119cf4093298c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, indicative of a link farm designed to distribute malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fencetreeproductions.com/uploads/1/3/0/4/130483978/gozigigasere.pdf In PDF document text
    • http://1technologyplace.com/uploads/1/3/0/6/130621947/ruwuzavidajor.pdfIn PDF document text
    • http://cardboardbuild.com/uploads/1/3/0/2/130288468/d1ada84c.pdfIn PDF document text
    • http://devonwheatonfitness.com/uploads/1/3/0/7/130775280/gazibifema.pdfIn PDF document text
    • http://www.iecep-bataan.com/uploads/1/3/0/6/130639781/875910.pdfIn PDF document text
    • http://fonestalve.com/uploads/1/3/0/5/130539679/niwaxurepopidir.pdfIn PDF document text
    • http://missrlong.com/uploads/1/3/0/5/130543837/b81b7.pdfIn PDF document text
    • http://mystarcleaner.com/uploads/1/3/0/5/130551518/mukuzalo_xezugaver_bipani_makabirivex.pdfIn PDF document text
    • http://hostmaster.eyhukuk.com/uploads/1/3/0/8/130874128/pesigiri_vidijunop_mojolofimevepiv.pdfIn PDF document text
    • http://thefastshopp.com/uploads/1/3/0/8/130874269/mixekaledexata.pdfIn PDF document text
    • http://armentalandscapeco.com/uploads/1/3/0/8/130814250/fedepaxaluwefig.pdfIn PDF document text
    • http://www.ganderviewoutfitters.com/uploads/1/3/0/6/130620371/5af13c1391b1.pdfIn PDF document text
    • http://cinescapedynamics.net/uploads/1/3/0/5/130590664/9472717.pdfIn PDF document text
    • http://nirthpanter.net/uploads/1/3/0/4/130476499/1886122.pdfIn PDF document text
    • http://rtpreston.com/uploads/1/3/0/3/130379228/zebudog-voluziro-rexogas-jegamuxawobi.pdfIn PDF document text
    • http://sweetsbykay.com/uploads/1/3/0/2/130273791/bugolekojozabuvosuv.pdfIn PDF document text
    • http://eumid.com/uploads/1/3/0/7/130775106/gewaretudata_muzobixaroxatij.pdfIn PDF document text
    • http://thewicklowway.org/uploads/1/3/0/7/130776499/ea245cacb2137.pdfIn PDF document text
    • http://nachomamasbedandsnack.com/uploads/1/3/0/6/130605080/ed920f70862a8a.pdfIn PDF document text
    • http://cookingtwothrive.com/uploads/1/3/0/2/130292148/adcd03f70450b7.pdfIn PDF document text
    • http://ww2.buyphilproperties.com/uploads/1/3/0/2/130272438/6303379.pdfIn PDF document text
    • http://codebeforedawn.net/uploads/1/3/0/4/130436139/4219019.pdfIn PDF document text
    • http://brookeamandaportfolio.com/uploads/1/3/0/8/130814993/7a6044.pdfIn PDF document text
    • http://atasteofjamaicaandmore.com/uploads/1/3/0/9/130969917/130969917.html#hungry+jack%27s+deals+qldIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002973.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2973 16036 bytes
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63
font_01_sfnt_off000040cf.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x40CF 8688 bytes
SHA-256: 43ad91f02f50482a830c581992cb00d7ad5c37aad657e08a2c11ec02bc56e18e

Open this report in the interactive analyzer, or submit your own file for analysis.