Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7f2ca62658afa3d…

MALICIOUS

PDF

38.0 KB Authoring application: PDF Studio First seen: 2020-09-24
MD5: 35404d570a7749ee67e3706f713d07be SHA-1: 970d5bb461edd78ebf6ca57166ccea3002f1fa44 SHA-256: c7f2ca62658afa3d2e265d6f19e0bcf2d94976ccdb12eaa5bc2c59c1274d70e0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and ML classification strongly supports its malicious nature. The document body text is heavily corrupted and unreadable, but the heuristic firings and numerous external URLs are sufficient to assess the attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kadydunlapprints.com/uploads/1/3/0/6/130639903/3575984.pdf In PDF document text
    • http://thepaleocaveman.com/uploads/1/3/0/6/130621149/5205030.pdfIn PDF document text
    • http://arredamentocucinevarese.it/uploads/1/3/0/8/130814178/70492b9260.pdfIn PDF document text
    • http://goodgoal.net/uploads/1/3/0/4/130478261/1790013.pdfIn PDF document text
    • http://education-innovations.org/uploads/1/3/0/6/130621025/f7c8bdc5ce13.pdfIn PDF document text
    • http://6monthsatatime.org/uploads/1/3/0/7/130739577/verawedag.pdfIn PDF document text
    • http://cynthiadahlwessling.com/uploads/1/3/0/5/130588942/fijakulelawobu-pevodaza-gesovup-wewixuxuwesexus.pdfIn PDF document text
    • http://numbersbeathunger.org/uploads/1/3/0/6/130620468/f33dc6.pdfIn PDF document text
    • http://thefirstandtheworst.com/uploads/1/3/0/5/130550885/xujiwib-sadeluxefaw.pdfIn PDF document text
    • http://evilsupervillain.com/uploads/1/3/0/7/130776582/zavepamisori_nulorade_jovem_suxifesepag.pdfIn PDF document text
    • http://diamondlgoats.net/uploads/1/3/0/4/130483761/sagalediv_vosomajipepoxar_kesimedadufo.pdfIn PDF document text
    • http://katiezerryoga.com/uploads/1/3/0/4/130483413/tiravomepagemumoxezo.pdfIn PDF document text
    • http://tuesdays4.com/uploads/1/3/0/4/130489830/3188866.pdfIn PDF document text
    • http://michellerosa.org/uploads/1/3/0/6/130603698/pokamubadesak.pdfIn PDF document text
    • http://www.thesweetestblooms.com/uploads/1/3/0/6/130604408/86c1f.pdfIn PDF document text
    • http://chironics.com/uploads/1/3/0/5/130588895/1960426.pdfIn PDF document text
    • http://cardeocreative.com/uploads/1/3/0/7/130775047/23928813f78386.pdfIn PDF document text
    • http://fencing44122.info/uploads/1/3/0/3/130313038/2484d27851554a.pdfIn PDF document text
    • http://iowajuniorcamp.com/uploads/1/3/0/7/130776760/802221.pdfIn PDF document text
    • http://goldenapplesect.org/uploads/1/3/0/6/130621245/vewuxoliwikuzi.pdfIn PDF document text
    • http://my.appleprint.co.uk/uploads/1/3/0/6/130604340/790d017835419.pdfIn PDF document text
    • http://studentshufur.net/uploads/1/3/0/4/130488569/8826940.pdfIn PDF document text
    • http://midiklorians.com/uploads/1/3/0/7/130739747/sawafegesex.pdfIn PDF document text
    • http://mindforyou.org/uploads/1/3/0/6/130620945/130620945.html#thrombocytopenia+workup+uptodateIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000024ba.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x24BA 2732 bytes
SHA-256: 717be01f407221fa3e96d352c4c1bf533bcdf925cc18647a3c5928760b0f7f6c
font_01_sfnt_off00003100.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3100 8056 bytes
SHA-256: 7495c9415443f9cfa4fd12ee133c2989138a98b10f2a38c31a5f2d73909ba997

Open this report in the interactive analyzer, or submit your own file for analysis.