Malicious PDF — malware analysis report

Static analysis result for SHA-256 e522f3181a3b2b44…

MALICIOUS

PDF

52.5 KB Authoring application: pstoedit First seen: 2020-12-25
MD5: 061c145e2f721f06c157a1c30f286f0e SHA-1: 5bfbdeb68df3ac5da9370f0e886e7e2ef557009f SHA-256: e522f3181a3b2b447910d60b6c68885d8b16fbab8beaf70ba2a76a4ec0639aa4
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, indicating a link farm or content distribution tactic. ClamAV detected this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a machine learning classifier also flagged it as malicious. The embedded URLs are likely used to redirect users to malicious sites or to manipulate search engine rankings.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nicolettamanusardicamicie.com/uploads/1/3/0/2/130270746/d35d9eff.pdf In PDF document text
    • http://romanticism55.com/uploads/1/3/0/3/130323934/8078325.pdfIn PDF document text
    • http://acs-kw.com/uploads/1/3/0/4/130483153/69698b2349af.pdfIn PDF document text
    • http://kleosnostos.com/uploads/1/3/0/6/130639397/lidadulafodiga_vimavixeri.pdfIn PDF document text
    • http://wearethepack.com/uploads/1/3/0/2/130273789/3c3bad21.pdfIn PDF document text
    • http://missperryseducationstation.com/uploads/1/3/0/3/130313428/bizuvalizela-jigejobapuj-sedogawuze.pdfIn PDF document text
    • http://eddiebotha.com/uploads/1/3/0/5/130550803/9486144.pdfIn PDF document text
    • http://genumelab.ecpn.su/uploads/2020/01/28/37a76a5e510d851.pdfIn PDF document text
    • http://lauraleerealty.com/uploads/1/3/0/7/130740524/fuwuluzajube.pdfIn PDF document text
    • http://familymedicineokc.com/uploads/1/3/0/7/130775376/0b2e9d.pdfIn PDF document text
    • http://elenatoscano.com/uploads/1/3/0/6/130605432/sekunujetafube-luvixo-fomavebokevol.pdfIn PDF document text
    • http://clucktruckportland.com/uploads/1/3/0/5/130551904/130551904.html#guard+driver+report+indian+railwayIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12C9 8080 bytes
SHA-256: 863407290106a05f5059bb9c49b8b427113bcd2e3ca4e64e6e3c9d7ed61566c0
font_01_sfnt_off000070a7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x70A7 8488 bytes
SHA-256: 695d32a31464879a38560a077af20fa58d5cd3e7a37627ea13601a1619266a92
font_02_sfnt_off0000866e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x866E 16164 bytes
SHA-256: 32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56

Open this report in the interactive analyzer, or submit your own file for analysis.