Malicious PDF — malware analysis report

Static analysis result for SHA-256 e09a4caa9bf21997…

MALICIOUS

PDF

40.7 KB Authoring application: PDFBox First seen: 2020-09-07
MD5: ae0ec8f560e1aea328457efab00814e7 SHA-1: 4f1f85ac80422bfb8074029f1df3f3b3d4507df4 SHA-256: e09a4caa9bf219978c7c581c9d24c8efea765681633addeff5c62dfab7e6fc28
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links to other PDF files hosted on various domains, indicating a link farm or redirection scheme. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support a malicious intent. The embedded URLs are likely used to distribute further malicious content or lead users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mwchamberlaingospelproductions.com/uploads/1/3/0/4/130483477/bezix_wilezomaba_sufokuru.pdf In PDF document text
    • http://maskcarabeautycolormatch.com/uploads/1/3/0/5/130588644/vasepuni.pdfIn PDF document text
    • http://jeffandeo.com/uploads/1/3/0/6/130620244/687b3b17.pdfIn PDF document text
    • http://thunderfunkpdx.com/uploads/1/3/0/4/130483138/zaxatebukofatoz.pdfIn PDF document text
    • http://ozarknaturalpaneling.com/uploads/1/3/0/7/130776169/nogodabufolevupitoz.pdfIn PDF document text
    • http://www.cprcia.org/uploads/1/3/0/5/130551927/lolejilikibazumenini.pdfIn PDF document text
    • http://citruslist.com/uploads/1/3/0/7/130775784/doxoz.pdfIn PDF document text
    • http://cpanel.hytbsknsadeg1.info/uploads/1/3/0/6/130604344/6a141f9ce.pdfIn PDF document text
    • http://autodiscover.arkoghosh.com/uploads/1/3/0/4/130490719/7715c45a4f97c7.pdfIn PDF document text
    • http://www.lykelvandevegt.nl/uploads/1/3/0/5/130539726/zefelimifa-pagimotivaz-ruxofit-lazusanase.pdfIn PDF document text
    • http://experiencedigital.co.uk/uploads/1/3/0/7/130740265/6ca76a.pdfIn PDF document text
    • http://solutionfocusedtherapys.org/uploads/1/3/0/6/130640021/1318583.pdfIn PDF document text
    • http://captainscutlawncare.com/uploads/1/3/0/4/130483886/serixi.pdfIn PDF document text
    • http://adsl-63-204-18-30.benefitplans.org/uploads/1/3/0/5/130550833/130550833.html#mens+shirt+stitching+tutorial+pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
🗂 Part of campaign: jeffandeo.com 4 samples

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003944.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3944 2616 bytes
SHA-256: d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04
font_01_sfnt_off000044ff.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x44FF 8200 bytes
SHA-256: 9d47c467789524fd3c35238f47277d7819af7f5a386e45829c2eab2802f5087c

Open this report in the interactive analyzer, or submit your own file for analysis.