Malicious PDF — malware analysis report

Static analysis result for SHA-256 cae4b3a20571fc26…

MALICIOUS

PDF

31.8 KB Authoring application: SWFTools First seen: 2020-09-24
MD5: d5a843ca8e91de696a6d136eca3cb6ac SHA-1: ac972a643ae7e5758a8cb906eb2111a5763d1cbb SHA-256: cae4b3a20571fc266859b60742f20f5029a32af9e2c6f2fa5f12f877ec145234
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The PDF_SEO_LINK_FARM heuristic indicates a large number of external links, with the first being http://northwestlouisianaautomationgroup.com/uploads/1/3/0/5/130541662/duzibolegosu_saxiwudiwoz_nunalipabax_gasadi.pdf. This suggests the document's primary purpose is to distribute malicious links, likely for phishing or malware distribution, rather than providing legitimate content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://northwestlouisianaautomationgroup.com/uploads/1/3/0/5/130541662/duzibolegosu_saxiwudiwoz_nunalipabax_gasadi.pdf In PDF document text
    • http://ultracooltrends.com/uploads/1/3/0/4/130488196/lulofiluguguj.pdfIn PDF document text
    • http://allisongiessuebelhair.com/uploads/1/3/0/5/130588506/df6ebd925.pdfIn PDF document text
    • http://miltonmurray.org/uploads/1/3/0/5/130550663/2605201.pdfIn PDF document text
    • http://theharrishawkinshometeam.com/uploads/1/3/0/5/130588811/nakukusaded_sipojujewif.pdfIn PDF document text
    • http://urfacefix.com/uploads/1/3/0/6/130603690/f8256db412.pdfIn PDF document text
    • http://newsolutionsit.com/uploads/1/3/0/5/130540118/5710471.pdfIn PDF document text
    • http://abeliangroup.ventures/uploads/1/3/0/5/130550752/derazedariwoke_nosebagita_gaderage_fulavesuse.pdfIn PDF document text
    • https://wegugivukenuvoz.weebly.com/uploads/1/3/0/5/130542996/segul.pdfIn PDF document text
    • http://millennialstitcher.com/uploads/1/3/0/6/130640218/7224631.pdfIn PDF document text
    • http://vpokerfriends.com/uploads/1/3/0/5/130588864/dobob.pdfIn PDF document text
    • http://spectaclesbroadway.com/uploads/1/3/0/6/130603896/sarexukepajig.pdfIn PDF document text
    • https://rudogidaf.weebly.com/uploads/1/3/0/5/130538831/suwutezofafa_butilexesi_loviripa.pdfIn PDF document text
    • http://djsacademy.com/uploads/1/3/0/4/130488833/130488833.html#gulf+breeze+dolaplar%C4%B1In PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013d9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13D9 9124 bytes
SHA-256: 010bf839269cebd85ced233d02446ad646097d614f1d31b864bc8e62323f879d

Open this report in the interactive analyzer, or submit your own file for analysis.