Malicious PDF — malware analysis report

Static analysis result for SHA-256 d7b83cf8190d6b4e…

MALICIOUS

PDF

47.0 KB Authoring application: ImageMagick First seen: 2020-09-24
MD5: 5304ce2e302c1ba60c4a7b56bcd32540 SHA-1: a01aa406a3e7b501056f881894968adc8477d391 SHA-256: d7b83cf8190d6b4eb9fe7f41cc2d065788d8f9494bb4dc3c76c84f3bda00a612
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of external links, many of which point to other PDF files, indicating a link farm designed for SEO manipulation. The document body presents a deceptive download prompt for a software converter, which is a common lure for phishing or malware distribution. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9987

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.getalyftbonus.com/uploads/1/3/0/6/130604812/wiwivafajum.pdf In PDF document text
    • http://prospernola.com/uploads/1/3/0/8/130814237/jasinor.pdfIn PDF document text
    • http://blueegg.net/uploads/1/3/0/5/130588531/7365150.pdfIn PDF document text
    • http://mieldercarelaw.com/uploads/1/3/0/8/130874133/23bbb3a7ff5.pdfIn PDF document text
    • http://cecilyeiferle.com/uploads/1/3/0/5/130543289/ebda113.pdfIn PDF document text
    • http://andaveycrea.com/uploads/1/3/0/5/130551876/gufula.pdfIn PDF document text
    • http://www.ayrical.com/uploads/1/3/0/2/130272573/7528928.pdfIn PDF document text
    • http://mhi-hoa.com/uploads/1/3/0/6/130621190/jozofebe.pdfIn PDF document text
    • http://2recommend.online/uploads/1/3/0/6/130639668/10af4119e.pdfIn PDF document text
    • http://nissanpatrolparts.com/uploads/1/3/0/6/130639476/75a4a41090f.pdfIn PDF document text
    • http://theloveboxcompanyonline.com/uploads/1/3/0/4/130489742/mixunasomudikofozeze.pdfIn PDF document text
    • http://clinicaespacosaudebeleza.net/uploads/1/3/0/3/130323523/riduzob.pdfIn PDF document text
    • http://norfolkeyephysiciansandsurgeons.com/uploads/1/3/0/8/130814416/nelotu.pdfIn PDF document text
    • http://cisledhockey.com/uploads/1/3/0/2/130271046/ruzedam-tawot.pdfIn PDF document text
    • http://catswearitsat.com/uploads/1/3/0/8/130814462/sotumoza.pdfIn PDF document text
    • http://teatottalers.com/uploads/1/3/0/8/130814843/megibikaroduve_rosas_dowadexot.pdfIn PDF document text
    • http://kwhitewc.com/uploads/1/3/0/2/130272979/wefitivebej.pdfIn PDF document text
    • http://hardcoretires.com/uploads/1/3/0/6/130621867/nogup-midiradurobagif-bejixizil.pdfIn PDF document text
    • http://toldoshorta.com/uploads/1/3/0/7/130738933/e82c8c11.pdfIn PDF document text
    • http://apacint.com.au/uploads/1/3/0/8/130814516/runuxakafituga.pdfIn PDF document text
    • http://artbookblog.org/uploads/1/3/0/8/130873794/muwifu_rokof_kaluwuturu.pdfIn PDF document text
    • http://onlygodcanjudgeus.com/uploads/1/3/0/6/130605030/denovidato.pdfIn PDF document text
    • http://miguelvaldiviezo.com/uploads/1/3/0/4/130491757/wupuraxurasujoguwez.pdfIn PDF document text
    • http://www.injury2019.nz/uploads/1/3/0/7/130739682/webiteruk.pdfIn PDF document text
    • http://huanqiuyulechengzhuye.br3h.com/uploads/1/3/0/9/130969262/130969262.html#english+to+hindi+converter+free+download+for+windows+7In PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003870.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3870 9348 bytes
SHA-256: d80f3d2cca52603524a074d611e27e3cb762a037ced4da2fd2b64e833ef7590e
font_01_sfnt_off00005419.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5419 8072 bytes
SHA-256: cc24ac0dbd5505d8d8dfef1a423f1cdc3106bf5e699acad6b3660f251a4b32e6

Open this report in the interactive analyzer, or submit your own file for analysis.