Malicious PDF — malware analysis report

Static analysis result for SHA-256 e3b6c3be5adce2e8…

MALICIOUS

PDF

100.0 KB Authoring application: ImageMagick First seen: 2020-09-24
MD5: e1305b34d0c74b098630f806c29b5b23 SHA-1: 223355c64192cf97d6b3369942d236d65e5a3fb9 SHA-256: e3b6c3be5adce2e8be8d3215222f08e3d28d1d8af670944233340aa4549ec6e6
152 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of external links, identified as a PDF_SEO_LINK_FARM heuristic. This suggests a phishing or SEO poisoning attack where the document's primary purpose is to redirect users to malicious or deceptive content hosted on external sites. The ClamAV detection and ML classifier further support its malicious nature, indicating it's likely a phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9989

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fivu.rus-snow.ru/uploads/2020/01/28/6621376.pdf In PDF document text
    • http://mialamaven.net/uploads/1/3/0/6/130620955/9425127.pdfIn PDF document text
    • https://lutunadepomonij.weebly.com/uploads/1/3/0/4/130483515/4181101.pdfIn PDF document text
    • http://themojo.ru/uploads/2020/01/27/6998725.pdfIn PDF document text
    • http://lucette-bijoux.fr/uploads/1/3/0/6/130639895/6790325.pdfIn PDF document text
    • http://adriantobin.com/uploads/1/3/0/2/130270907/1580763.pdfIn PDF document text
    • http://castlescoins.com/uploads/1/3/0/6/130622036/kuvapoxi_wesatazewi.pdfIn PDF document text
    • http://rcbinns.com/uploads/1/3/0/4/130483402/magixoxojosat-mosevorujunigip-vipimevip-mudoripefaz.pdfIn PDF document text
    • http://sdgplanning.com/uploads/1/3/0/4/130478004/sifekewazob_fogilerapukida_xalufenure.pdfIn PDF document text
    • http://asociacionperiodistaspr.org/uploads/1/3/0/3/130313333/130313333.html#language+acquisition+definition+and+examplesIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001406.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1406 9968 bytes
SHA-256: 5cd9e0cf79d3b29d50005f4dc03aa9488305b269f943513efbfb3f059285b883

Open this report in the interactive analyzer, or submit your own file for analysis.