Malicious PDF — malware analysis report

Static analysis result for SHA-256 d17871b909c207dd…

MALICIOUS

PDF

38.3 KB Authoring application: Soda PDF First seen: 2020-09-24
MD5: 8e8047531f79b783d29a1a5f6fb709e5 SHA-1: ea509c1dcface1c1b85f5fbbae98a4b87bb2220e SHA-256: d17871b909c207dda8a3c8217371dc835f8428d002892ade9dc66625bf936c94
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a link farm or redirection mechanism designed to lead users to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious traffic generation intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://faswer.space/uploads/1/3/0/7/130738673/redurudikolod_popagafitazipa.pdf In PDF document text
    • http://desvioindefinido.com/uploads/1/3/0/5/130588360/jodexi.pdfIn PDF document text
    • http://webdisk.shabuworcester.com/uploads/1/3/0/5/130551941/8e0fded415.pdfIn PDF document text
    • http://jackiesaad.com/uploads/1/3/0/8/130874488/mitedapa_latow_tuwuvupabu.pdfIn PDF document text
    • http://www.theofficialinternetstore.com/uploads/1/3/0/5/130590531/a40ae0c44f0be6.pdfIn PDF document text
    • http://www.3dvitog.com/uploads/1/3/0/6/130621896/mijotasujupade_lidusufajera_saniwatuzirovof.pdfIn PDF document text
    • http://www.muvnao.com/uploads/1/3/0/6/130620625/wolipimup.pdfIn PDF document text
    • http://kimibath.com/uploads/1/3/0/5/130543156/benefafepajemewu.pdfIn PDF document text
    • http://hostmaster.onvousdemenage.ch/uploads/1/3/0/7/130775205/6301d72b258.pdfIn PDF document text
    • http://choice-components.com/uploads/1/3/0/6/130604090/vudusiwej.pdfIn PDF document text
    • http://fasholdingscorp.com/uploads/1/3/0/8/130874313/taromafe_fozemepi_dajub.pdfIn PDF document text
    • http://universodobingo.com/uploads/1/3/0/6/130621706/rosep.pdfIn PDF document text
    • http://humblebundleofjoy.com/uploads/1/3/0/6/130620926/9360481.pdfIn PDF document text
    • http://summitcrest.ca/uploads/1/3/0/6/130640006/kafawegalud-tarotofonazono.pdfIn PDF document text
    • http://frankbeanprinting.com/uploads/1/3/0/7/130775125/tizarexiputakajurit.pdfIn PDF document text
    • http://www.personalisedportraitsnortheast.com/uploads/1/3/0/8/130874146/gigane_jibumidewa_rasofoj_polawisexoxaz.pdfIn PDF document text
    • http://myeclecticyoga.com/uploads/1/3/0/2/130288554/buterepuvenon.pdfIn PDF document text
    • http://aleonor1to1.com/uploads/1/3/0/3/130323178/gakajutetiki_xusukojitorod.pdfIn PDF document text
    • http://3505brunell.net/uploads/1/3/0/5/130551832/c79a13f2c75669.pdfIn PDF document text
    • http://oddrodcreations.net/uploads/1/3/0/2/130288486/vikotaje.pdfIn PDF document text
    • http://missingbell.com/uploads/1/3/0/5/130538833/d2ce7c3b0.pdfIn PDF document text
    • http://mindforyou.org/uploads/1/3/0/2/130272102/130272102.html#microsoft+sculpt+ergonomic+mouse+lagIn PDF document text
🗂 Part of campaign: 3505brunell.net 8 samples

Related samples 5

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000348c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x348C 8056 bytes
SHA-256: 39dc338c234c21c8912121068b7dde1ee4233bdcb3e6899e2ac5745fd9efea6f

Open this report in the interactive analyzer, or submit your own file for analysis.