Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7ac3b05a236a0c3…

MALICIOUS

PDF

39.1 KB Authoring application: ImageMagick First seen: 2020-09-24
MD5: 2af88b2cd18b224875c2b89365d6d26f SHA-1: 34cc89ce90125ef3b0d893f3cc46d36f047e225a SHA-256: c7ac3b05a236a0c36c09278c10a2c5357aea3634a32ee1bff90b697729a9ac83
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. This indicates a deliberate attempt to direct users to a network of potentially malicious websites. The ClamAV detection and ML classifier further support its malicious nature, classifying it as phishing-related. No scripts were extracted, and the document body content is heavily obfuscated and unreadable, providing no further clues about the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kotdobryak.site/uploads/1/3/0/6/130639115/xexifenakerupa.pdf In PDF document text
    • http://sexpressyourself.com/uploads/1/3/0/5/130590777/f7c1b66ac8ae3.pdfIn PDF document text
    • http://finemexican.com/uploads/1/3/0/6/130620367/8432631.pdfIn PDF document text
    • http://internetradiochat.com/uploads/1/3/0/2/130289628/9459045.pdfIn PDF document text
    • http://adsmanila.com/uploads/1/3/0/5/130589163/gejuxigunini.pdfIn PDF document text
    • http://rekopyr.store/uploads/1/3/0/6/130621836/8916134.pdfIn PDF document text
    • http://thebirthbee.com/uploads/1/3/0/3/130379336/1189230.pdfIn PDF document text
    • http://norwichmonsters.com/uploads/1/3/0/4/130483928/68cca0.pdfIn PDF document text
    • http://cefcamas.org/uploads/1/3/0/4/130476065/nikim_sizilalug_vonupet_guref.pdfIn PDF document text
    • http://tomsalf.store/uploads/1/3/0/4/130435702/tukajetopa-jozewevirup-jiranaduvobe-tiranoxelivu.pdfIn PDF document text
    • http://netmassive.net/uploads/1/3/0/5/130589288/1458493.pdfIn PDF document text
    • http://glebl.bpmtc.com/uploads/1/3/0/2/130287852/130287852.html#dka+management+protocolIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000035ce.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x35CE 2616 bytes
SHA-256: 9c441396c78fcec381b139909df8eae4e3e4b3b77c9f9e3b7c3f2073b33ed4b0
font_01_sfnt_off000041a6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x41A6 8440 bytes
SHA-256: 4cb0db956794018b63d645c7811c7e6a9478ac50d3445d424d77add04f4b81dd

Open this report in the interactive analyzer, or submit your own file for analysis.