Malicious PDF — malware analysis report

Static analysis result for SHA-256 de6c29a25efdfcc1…

MALICIOUS

PDF

44.9 KB Authoring application: Mobipocket Creator First seen: 2020-09-24
MD5: 11c2e7a11329ce10fa2be391171eb716 SHA-1: a1842bbe2c99c26dc98e622bf2c6483a59fe1910 SHA-256: de6c29a25efdfcc1d5b4e99f53c7b01108604e5386d439bef96c68182e5ed68c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly indicate malicious intent, classifying it as Pdf.Phishing.TtraffRobotInstall. The document body, though partially obfuscated, also contains many of these links, suggesting a phishing or SEO manipulation scheme. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://voiceschorale.org/uploads/1/3/0/3/130313027/tusejivuvogale.pdf In PDF document text
    • http://visitwesternheritagecenter.org/uploads/1/3/0/6/130620605/verimanuwugof_sololi_ritutawigawuv_kalekepasisatuj.pdfIn PDF document text
    • http://drhiura.net/uploads/1/3/0/6/130621730/acebf607ed2e8.pdfIn PDF document text
    • http://villageartproject.com/uploads/1/3/0/3/130313228/2ba036c628.pdfIn PDF document text
    • http://mikewoodhead.com/uploads/1/3/0/3/130313157/guzuren-gopojufapin-ruvavegikobu-bivoxowokodof.pdfIn PDF document text
    • http://theallergyfreezone.com/uploads/1/3/0/5/130542755/91dcd5132151.pdfIn PDF document text
    • http://aearthsport.com/uploads/1/3/0/6/130605302/vajubisipo_gokubefe_mexuso_kisawamuzikofa.pdfIn PDF document text
    • http://aninconvenientcommute.com/uploads/1/3/0/5/130551271/lejogikus.pdfIn PDF document text
    • http://billyjackray.com/uploads/1/3/0/6/130639947/gaxozevi_zovolej_fukas.pdfIn PDF document text
    • http://309brightfuture.org/uploads/1/3/0/6/130604427/7139468.pdfIn PDF document text
    • http://love-your-mind.com/uploads/1/3/0/2/130291552/aadc6aa6.pdfIn PDF document text
    • http://kylaconner.com/uploads/1/3/0/5/130588827/130588827.html#jcole+4+your+eyez+only+downloadIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001359.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1359 8116 bytes
SHA-256: 818ec4cc306d44ef817a1a57ce77a0bb9be03be06407d55f5c9021bbee0314ed
font_01_sfnt_off000062f2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x62F2 8716 bytes
SHA-256: bdcfe833d3631b708f0b8a76b8d82f8a11cc6cd4486a9bbbdd73a01ab4899b53

Open this report in the interactive analyzer, or submit your own file for analysis.