Malicious PDF — malware analysis report

Static analysis result for SHA-256 c37584010eb3a469…

MALICIOUS

PDF

57.1 KB Authoring application: SWFTools First seen: 2020-09-24
MD5: e8dd2906a71c313c99a8a0b37e2058fb SHA-1: 3ada554adb77346c19466d0427ab78e111b55207 SHA-256: c37584010eb3a46968fa26a54d7b6dcd0d1f5c871b8ffb3e90b124040ee41cd5
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, a technique commonly used in SEO poisoning to drive traffic to malicious sites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The primary heuristic 'PDF_SEO_LINK_FARM' identifies the mass linking to external PDFs as the core malicious activity, with the first URL being http://karinaterrazas.com/uploads/1/3/0/2/130272557/zaxilab-rokijelaw-bogobatijuxop-pipaxoriwajuf.pdf.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://karinaterrazas.com/uploads/1/3/0/2/130272557/zaxilab-rokijelaw-bogobatijuxop-pipaxoriwajuf.pdf In PDF document text
    • http://nuvisionconstruction.com/uploads/1/3/0/5/130590653/sanijedefojo-bewux-dejoze.pdfIn PDF document text
    • http://dpjutzi.com/uploads/1/3/0/6/130639291/sadivag.pdfIn PDF document text
    • http://harvestleaders.org/uploads/1/3/0/3/130323260/d976b9676f86e92.pdfIn PDF document text
    • http://beyondbedside.com/uploads/1/3/0/8/130814337/dinumozibonofi.pdfIn PDF document text
    • http://sanctuaryelectrical.com/uploads/1/3/0/4/130492771/lanekazogupe_merejatan_zatibagotiteg.pdfIn PDF document text
    • http://esavvie.com/uploads/1/3/0/2/130291579/1542b82b133.pdfIn PDF document text
    • http://bigislandpartyrentals.com/uploads/1/3/0/7/130775734/sojowofusex_pekitoziniselu_zuwelilij.pdfIn PDF document text
    • http://tammyframptonrealty.ca/uploads/1/3/0/6/130639147/xirujapixu_kobeweki.pdfIn PDF document text
    • http://kohltechwindows.com/uploads/1/3/0/7/130740084/gasokuzonupis_dulen_relizibakof.pdfIn PDF document text
    • http://stmmlwr.org/uploads/1/3/0/7/130738603/gexuziwizizinuvi.pdfIn PDF document text
    • http://washingtonweed.guru/uploads/1/3/0/6/130620861/5700303.pdfIn PDF document text
    • http://abc-lyd.com/uploads/1/3/0/4/130476611/vapetiropubiz-xonavef-milad.pdfIn PDF document text
    • http://anitaleverarttherapist.com/uploads/1/3/0/5/130551671/pebawejefewez.pdfIn PDF document text
    • http://ronyah-arts.com/uploads/1/3/0/2/130291769/jaxowamiwudakil_seburonobo_zofexewago.pdfIn PDF document text
    • http://nipmucprincipal.com/uploads/1/3/0/5/130589288/sapubu.pdfIn PDF document text
    • http://scrambledtosunnysideup.com/uploads/1/3/0/6/130605368/83ae9396eae.pdfIn PDF document text
    • http://www.stteresaofavilacatholiccommunity.org/uploads/1/3/0/4/130483937/fasolanozomuv.pdfIn PDF document text
    • http://livelongyoga.com/uploads/1/3/0/5/130589191/6b1e4da87990096.pdfIn PDF document text
    • http://bentoone.com/uploads/1/3/0/7/130776034/53790164c66d8.pdfIn PDF document text
    • http://colacotwayartstrail.com/uploads/1/3/0/4/130435650/3665030.pdfIn PDF document text
    • http://buythebirdseed.com/uploads/1/3/0/7/130740211/5675227.pdfIn PDF document text
    • http://shgrp.com/uploads/1/3/0/4/130435875/2daa67f01467bb.pdfIn PDF document text
    • http://marijuanabusinessplans.com/uploads/1/3/0/3/130323163/130323163.html#chinese+hanyu+pinyin+dictionaryIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://imawoikiru.saga-s.co.jp/uploads/1/3/0/5/130589396/474b5d.pdfIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00003fba.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x3FBA 7752 bytes
SHA-256: 9a20fc2c8a4fd9e07c38f8864c16f8db45eb13d433160899eba85e0efcb48088
font_01_sfnt_off000057e1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x57E1 2600 bytes
SHA-256: 63f5e27ee3d24cc00d413e59c301cc73ab377383609796993547673f2bea898c
font_02_sfnt_off0000608d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x608D 16212 bytes
SHA-256: f6ad48e79c07c7ff1d65e8120844a1c4346b00864b8e7c8fc9f5b4b7b7113106
font_03_sfnt_off000078fa.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x78FA 8864 bytes
SHA-256: fbb5af7443315939fbd4ea8739a13da747bf79e25eccdc874f80ef469dc0ffa8

Open this report in the interactive analyzer, or submit your own file for analysis.