Malicious PDF — malware analysis report

Static analysis result for SHA-256 cde9b71440137a73…

MALICIOUS

PDF

52.3 KB Authoring application: GIMP First seen: 2020-09-24
MD5: 97a7c2de67c80a5edad8010ed6450366 SHA-1: ae4e103d3edbd5943d64a330470f3ff2677f2a01 SHA-256: cde9b71440137a7370664ff3ea61e1eb21adc14248d940f644f1a173449f4015
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various PDF files. This indicates a likely attempt to distribute malicious content or conduct phishing through a link farm. The ML classifier and ClamAV detection strongly support the malicious verdict. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://puxoxumi.like-ball.com/uploads/2020/01/27/bd4c5e34262651.pdf In PDF document text
    • http://caitlinmorrison.com/uploads/1/3/0/4/130476004/kazojovuver_warekutapes_weperenip.pdfIn PDF document text
    • http://tuzedo.1-gc.org/uploads/2020/01/28/7081582.pdfIn PDF document text
    • http://dateurbate.club/uploads/2020/01/28/6481b2d32ba691.pdfIn PDF document text
    • http://nicholsonsbar.com/uploads/1/3/0/6/130604185/runojag_toludoduzusutiv_xoxonagepabozas.pdfIn PDF document text
    • http://mycthomson.com/uploads/1/3/0/2/130272973/gaxako-gizepovo-kixabudinuv-rinutevopavak.pdfIn PDF document text
    • http://morongovalley.org/uploads/1/3/0/4/130476342/xijowogiduvupu.pdfIn PDF document text
    • http://arteducationdesign.com/uploads/1/3/0/2/130289259/761495e94a.pdfIn PDF document text
    • http://fetafi.coldmineral-soap.com/uploads/2020/01/27/1390131.pdfIn PDF document text
    • http://naydacollazollorens.weebly.com/uploads/1/3/0/6/130604768/memedozuxumemaj-rodaraxofagome-pojoxaxururo.pdfIn PDF document text
    • https://gegifekamupo.weebly.com/uploads/1/3/0/3/130379049/muvitiwedivuv-xojuxule-revakoje-fuxefiwatuvota.pdfIn PDF document text
    • http://sminkguiden.com/uploads/1/3/0/3/130323461/xiwukajunive.pdfIn PDF document text
    • http://audioallure.com/uploads/1/3/0/5/130539344/xaganesejej.pdfIn PDF document text
    • http://nicolemartinetti.com/uploads/1/3/0/2/130288341/7f7d666e4c6.pdfIn PDF document text
    • http://poesie-maze.net/uploads/1/3/0/5/130550672/wagupusedobeso.pdfIn PDF document text
    • http://metconeng.ca/uploads/1/3/0/5/130551066/febikepef.pdfIn PDF document text
    • http://tesaku.rosstelekom.pro/uploads/2020/01/27/45d7c912014.pdfIn PDF document text
    • http://yoga-with-neil.weebly.com/uploads/1/3/0/4/130489055/4184847.pdfIn PDF document text
    • https://judigukukegenat.weebly.com/uploads/1/3/0/5/130590126/9886362.pdfIn PDF document text
    • http://nov.secondlives.biz/uploads/2020/01/28/1464946.pdfIn PDF document text
    • http://adayofhope.co/uploads/1/3/0/3/130379445/najav.pdfIn PDF document text
    • http://mfengshui.com/uploads/1/3/0/5/130550681/xomuwasodo-ximuxubuteporo.pdfIn PDF document text
    • http://top-shop21.ru/uploads/2020/01/29/5231147.pdfIn PDF document text
    • http://dougzanderart.com/uploads/1/3/0/5/130543141/6724811.pdfIn PDF document text
    • http://kreativekidsworld.com/uploads/1/3/0/6/130603789/130603789.html#sony+vtc6+datasheet+pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text
🗂 Part of campaign: excelappdevelopment.com 12 samples

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000019a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x19A0 9860 bytes
SHA-256: 27585495dd50db85cc54c3afe9309f2e66c186209a7e278b12729b4ea7c6f1f6
font_01_sfnt_off00007245.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7245 16560 bytes
SHA-256: 9d36b2815cb67e6f65ee2b06e336b71ffe1355dec6626ce4666a016e66c102b1
font_02_sfnt_off00008875.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x8875 5532 bytes
SHA-256: c9f2766864d727e1393aa645f689f1e349cca9ca80d00af93de57b1bbf7dc8a8

Open this report in the interactive analyzer, or submit your own file for analysis.