Malicious PDF — malware analysis report

Static analysis result for SHA-256 d2c6d3a343676197…

MALICIOUS

PDF

28.6 KB Authoring application: SWFTools First seen: 2020-09-24
MD5: e24b22b59f3fa52ea4cb295aeee7f772 SHA-1: 54a4bba83db61bd29f7cc579a6d80ebecfc2aff1 SHA-256: d2c6d3a34367619775277d7db64f16dc982b3bd3b6ed988f2e04b39aa834aef7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The critical PDF_SEO_LINK_FARM heuristic indicates the presence of a large number of embedded links to external PDF files, with the first identified URL being http://simplinow.tech/uploads/1/3/0/7/130775729/8c5c97aa7e.pdf. This suggests the document is designed to redirect users to a network of malicious sites, likely for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://simplinow.tech/uploads/1/3/0/7/130775729/8c5c97aa7e.pdf In PDF document text
    • http://tahoegoogletours.com/uploads/1/3/0/3/130313263/ponirapusoxilataz.pdfIn PDF document text
    • http://almahruqicars.com/uploads/1/3/0/5/130550940/vavibodixuja-beserikigusenuf-benixewateji-pololasixu.pdfIn PDF document text
    • http://shangrila.com/uploads/1/3/0/6/130605065/d7fafb16ea9b9a.pdfIn PDF document text
    • http://arielledollinger.com/uploads/1/3/0/6/130605307/xirewogi.pdfIn PDF document text
    • http://ahstigerband.org/uploads/1/3/0/3/130313224/0883b87eff9361.pdfIn PDF document text
    • http://pmehard.com/uploads/1/3/0/4/130476766/7491412.pdfIn PDF document text
    • http://rickformichigan.net/uploads/1/3/0/7/130739056/1153286.pdfIn PDF document text
    • http://beaute-totale.com/uploads/1/3/0/6/130639664/74fd972.pdfIn PDF document text
    • http://rokuhispano.com/uploads/1/3/0/7/130740536/jevufarubojomirisu.pdfIn PDF document text
    • http://mediquips.com/uploads/1/3/0/3/130312973/lokaxugade_xalefuxaz_nigubuxuka.pdfIn PDF document text
    • http://domainr.blog/uploads/1/3/0/6/130620510/jelokap-roxapapajitonoz-bazadewuxet-rafat.pdfIn PDF document text
    • http://artofburkinafaso.com/uploads/1/3/0/6/130621775/8856295.pdfIn PDF document text
    • http://localprintshop.com/uploads/1/3/0/2/130289359/9155861.pdfIn PDF document text
    • http://pokupki.space/uploads/1/3/0/2/130287502/nabibasefiveketasim.pdfIn PDF document text
    • http://dollarstopparty.com/uploads/1/3/0/7/130775357/jolufisumufakefenuj.pdfIn PDF document text
    • http://multistreams.com/uploads/1/3/0/6/130620283/130620283.html#triphenylmethanol+h+nmr+analysisIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016a9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x16A9 6716 bytes
SHA-256: bbaebe63ddf2ceddaf2055bb6663ef83763879478f2486a7abe4852230f52243

Open this report in the interactive analyzer, or submit your own file for analysis.