Malicious PDF — malware analysis report

Static analysis result for SHA-256 ca586404ad32e19f…

MALICIOUS

PDF

46.7 KB Authoring application: PDF Studio First seen: 2020-09-24
MD5: 1c5711bf400949245b47a981604c1ed5 SHA-1: 9388d4c0feddf006dd26a06c4a84a46b33ccad38 SHA-256: ca586404ad32e19f55a878b092c380592418b456bf891178ff67febd500ec011
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified as a link farm, with the primary URL being http://setsdrama.org/uploads/1/3/0/4/130489604/9776589.pdf. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the 'PDF_SEO_LINK_FARM' heuristic strongly indicate a phishing or traffic-driving campaign. The presence of a 'SE_DOWNLOAD_BUTTON' heuristic further supports the lure mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://setsdrama.org/uploads/1/3/0/4/130489604/9776589.pdf In PDF document text
    • http://koxivokuf.repuljvelunk.website/uploads/2020/01/28/refidelumelinar.pdfIn PDF document text
    • http://jaxasezi.kekleads.com/uploads/2020/01/29/bulorek-kobine.pdfIn PDF document text
    • https://kamowexu.weebly.com/uploads/1/3/0/2/130289530/lanejoje-ralavimeto-lepadatovut.pdfIn PDF document text
    • http://jume.blogmale.pw/uploads/2020/01/27/fupaxo.pdfIn PDF document text
    • http://nozakixogo.cuelol.info/uploads/2020/01/27/wituma-womadigunezu.pdfIn PDF document text
    • https://zenuwalag.weebly.com/uploads/1/3/0/5/130551247/losodunabifunud.pdfIn PDF document text
    • http://commercialequipmentparts.com/uploads/1/3/0/5/130544898/b2002e55f.pdfIn PDF document text
    • http://puwikigej.invoicing.space/uploads/2020/01/27/lunatijujagix-wuvej-lekewibana-detejife.pdfIn PDF document text
    • http://vete.jahtennaja-shkola.ru/uploads/2020/01/28/4bf2a.pdfIn PDF document text
    • https://dafozufajuzun.weebly.com/uploads/1/3/0/5/130541140/6516025.pdfIn PDF document text
    • http://ferreirawellness.com/uploads/1/3/0/4/130476816/nivezujo.pdfIn PDF document text
    • http://7000extreme.com/uploads/1/3/0/6/130603808/divufadijoz-kosebenupoxejut-zaparixo-xonazowumi.pdfIn PDF document text
    • http://cherylgrayfineart.com/uploads/1/3/0/2/130272102/zidinodofelidanomesu.pdfIn PDF document text
    • http://waka.amitsheth.net/uploads/2020/01/28/aae2413c1fac9f7.pdfIn PDF document text
    • http://lujatatibe.kupitzerkalo.ru/uploads/2020/01/27/vudedibafir.pdfIn PDF document text
    • http://rogujurepe.meriphotographe.com/uploads/2020/01/28/nakifovisawe.pdfIn PDF document text
    • http://capecodcoastalhomeinsurance.com/uploads/1/3/0/4/130476853/4805734.pdfIn PDF document text
    • http://butosaroko.fxtradeltd.info/uploads/2020/01/28/vefurewibozis.pdfIn PDF document text
    • http://jijamowo.fineremont.ru/uploads/2020/01/27/4474b8c95.pdfIn PDF document text
    • http://ximew.onemagazin.ru/uploads/2020/01/27/8786840.pdfIn PDF document text
    • https://raxupizimav.weebly.com/uploads/1/3/0/4/130476006/1834085.pdfIn PDF document text
    • http://veporuto.bungartz.ru/uploads/2020/01/28/piriga_nowidun_tuwefivutugirip_vunafufugomos.pdfIn PDF document text
    • http://luisacostagomes.com/uploads/1/3/0/5/130589297/3241438.pdfIn PDF document text
    • http://wimuto.angrybirds.tech/uploads/2020/01/28/4b3816b253945.pdfIn PDF document text
    • http://bassittdesigns.com/uploads/1/3/0/3/130323210/130323210.html#download+photoshop+cs7+portable+full+versionIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000019a1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19A1 7920 bytes
SHA-256: 8f7a58e928b4ddebf9263b766fae3756ae7dee7d1dba52a5cd7109d1ab46eec5
font_01_sfnt_off00006e37.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6E37 16268 bytes
SHA-256: 5d7ebd720715cd86529581f1d40cc643f68465477bd430d4be5ff736bc95f798

Open this report in the interactive analyzer, or submit your own file for analysis.