Malicious PDF — malware analysis report

Static analysis result for SHA-256 de22e257c0b2bab3…

MALICIOUS

PDF

39.9 KB Authoring application: Solid Converter PDF First seen: 2020-09-24
MD5: b894bae61fca23a8a4420acb1e7563f0 SHA-1: b172bd1d16248f871f07d62baf522730822ec540 SHA-256: de22e257c0b2bab3dbecc529579535ba34bcc397c48bb8d31aabf5fa1f6c0bcd
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or a distribution mechanism for malicious content. The ClamAV detection and ML classifier further support its malicious nature. The document body content appears to be corrupted or malformed, preventing a clear understanding of its immediate lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jokebits.net/uploads/1/3/0/5/130551391/jusoro_nekilulorola.pdf In PDF document text
    • http://thewebsterfam.com/uploads/1/3/0/6/130604637/kovipos_zijidog_pamoxejumatawa_pupetidopudeber.pdfIn PDF document text
    • http://www.pictureperfectdesigners.com/uploads/1/3/0/6/130605357/zonelinad-pisos-gafizo-loxaf.pdfIn PDF document text
    • http://unknownmuzic.com/uploads/1/3/0/9/130969430/a1356e1761af4e9.pdfIn PDF document text
    • http://vrwresting.com/uploads/1/3/0/2/130289476/21188f06b021.pdfIn PDF document text
    • http://gatascuritiba.com/uploads/1/3/0/7/130739446/sisozidawopotakixow.pdfIn PDF document text
    • http://michaelronaldblake.com/uploads/1/3/0/5/130588248/rusov_bomalofowutob_nazap.pdfIn PDF document text
    • http://macmarketplace.net/uploads/1/3/0/5/130551257/310c5.pdfIn PDF document text
    • http://mentalhealthdays.org/uploads/1/3/0/8/130814187/6308293.pdfIn PDF document text
    • http://artintimidatinglife.com/uploads/1/3/0/6/130621025/babiw.pdfIn PDF document text
    • http://grupit.com/uploads/1/3/0/5/130589345/7543497.pdfIn PDF document text
    • http://tieroneacademy.net/uploads/1/3/0/2/130271207/rijiv.pdfIn PDF document text
    • http://2bsaltnlight.com/uploads/1/3/0/7/130775749/9836549.pdfIn PDF document text
    • http://psychomotricite-pays-bas.com/uploads/1/3/0/7/130739830/ranelejaxisejuz.pdfIn PDF document text
    • http://southernfrontrange.com/uploads/1/3/0/5/130588527/9286411.pdfIn PDF document text
    • http://marmiger.com/uploads/1/3/0/5/130539726/e658a.pdfIn PDF document text
    • http://microbladingcairns.com/uploads/1/3/0/6/130621228/c90deff.pdfIn PDF document text
    • http://mikemasseywealthmanager.com/uploads/1/3/0/5/130543483/zoguragusatipig.pdfIn PDF document text
    • http://town-countryremodeling.com/uploads/1/3/0/6/130603779/5098530.pdfIn PDF document text
    • http://olympic-custom-construction.com/uploads/1/3/0/5/130589020/cd4ea9a3fa8.pdfIn PDF document text
    • http://domesticabuseministry.org/uploads/1/3/0/3/130313049/bosanun_juvajexal_pugufugipasulor.pdfIn PDF document text
    • http://yahnketreeservice.com/uploads/1/3/0/5/130588922/9994197.pdfIn PDF document text
    • http://www.cfbmediation.com/uploads/1/3/0/5/130588403/5688121.pdfIn PDF document text
    • http://lykkenkommerindefra.dk/uploads/1/3/0/7/130776334/130776334.html#simple+past+regular+verbs+positive+negative+and+questions+exerciseIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001c07.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1C07 16060 bytes
SHA-256: 40a403f8312ff9c93041e514e965a4d57d797ba541f1da729710ef172887bfc2
font_01_sfnt_off00003049.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3049 2652 bytes
SHA-256: e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea
font_02_sfnt_off00003bb3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3BB3 6800 bytes
SHA-256: 8c17cd6ad04a71db4fd54fea323fb48347e7906b1c19caf185d815e2231412b8

Open this report in the interactive analyzer, or submit your own file for analysis.