Malicious PDF — malware analysis report

Static analysis result for SHA-256 e75bf959f91fb2e7…

MALICIOUS

PDF

60.9 KB Authoring application: PDFedit First seen: 2020-09-24
MD5: 39c2f451fa7856264263178e1f4ebd63 SHA-1: 1c83ef494315e2c50ab300cb1d79d83e044f5fc6 SHA-256: e75bf959f91fb2e7179a12fe31a9c33780a520a3d4f7b1cbb1d0bb0e0d476334
172 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier, indicating a high likelihood of malicious intent. The heuristic 'PDF_SEO_LINK_FARM' and the presence of numerous embedded URLs suggest the document is designed to redirect users to a large number of external PDF files, likely for phishing or malware distribution. The 'SE_CALLBACK_LURE' heuristic further suggests a social engineering tactic, possibly to trick users into downloading further malicious content or revealing sensitive information.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns. Suppressed for legitimate-issuer (IRS/gov/official-form) or Microsoft license-boilerplate documents that carry no urgency or charge/dispute escalation.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://movertoolkit.com/uploads/1/3/0/2/130291441/lozedazasaxo-futex-minamixesovut.pdf In PDF document text
    • http://dogsprikaz.weebly.com/uploads/1/3/0/6/130620869/8937420.pdfIn PDF document text
    • http://mrgrantmath.com/uploads/1/3/0/6/130620567/wetibunola.pdfIn PDF document text
    • http://campchow.net/uploads/1/3/0/5/130544070/4453120.pdfIn PDF document text
    • http://257bennettstreet.com/uploads/1/3/0/6/130605212/1962552.pdfIn PDF document text
    • http://joduveza.jobok.fun/uploads/2020/01/28/8522710.pdfIn PDF document text
    • http://peaceofmindkindercare.com/uploads/1/3/0/2/130289340/xegak-fumurinuxomuw-guvebokuw.pdfIn PDF document text
    • http://narskuuttelu.com/uploads/1/3/0/6/130621257/zesope.pdfIn PDF document text
    • http://macronbit.com/uploads/2020/01/27/93ad827a4e.pdfIn PDF document text
    • http://vuongholdings.com/uploads/1/3/0/6/130604487/e497c7f78.pdfIn PDF document text
    • http://pex.fisiodoctor.ru/uploads/2020/01/27/9a097226c89f.pdfIn PDF document text
    • http://pruittconsulting.org/uploads/1/3/0/6/130620456/vekasotokire-begumusil-zolibomonu.pdfIn PDF document text
    • http://ninarayviola.com/uploads/1/3/0/5/130588492/a7bc53.pdfIn PDF document text
    • http://matchboxorganics.com/uploads/1/3/0/3/130323406/piwene-zekarenofodiva-navufa-wufijatefum.pdfIn PDF document text
    • http://sonsetministries.com/uploads/1/3/0/4/130475990/kamupolunu_xorag_zamiveraro.pdfIn PDF document text
    • http://rexaji.paulandkelsey.com/uploads/2020/01/28/a8be08664.pdfIn PDF document text
    • http://panoramicgalaxy.com/uploads/1/3/0/6/130620491/wowawu.pdfIn PDF document text
    • http://vicelone.com/uploads/1/3/0/5/130589337/7716732.pdfIn PDF document text
    • http://coratoloassociatesllc.com/uploads/1/3/0/4/130483050/mixenubimire-karorufezo-wenutezawagiro.pdfIn PDF document text
    • http://msestate.co.jp/uploads/1/3/0/2/130291803/nawase.pdfIn PDF document text
    • http://dramallamaranch.com/uploads/1/3/0/5/130543353/tuderaludoxupifoju.pdfIn PDF document text
    • http://butazaga.zincadoexpress.com/uploads/2020/01/27/0049810673c.pdfIn PDF document text
    • http://sweetestdreams.org/uploads/1/3/0/6/130605122/130605122.html#security+antivirus+max+clean+apkIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 5

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000184a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x184A 8236 bytes
SHA-256: 1fa3b90fee2242523f5431ab024b4c57c48705e176a0b615744ac7649e2e13bb
font_01_sfnt_off00006f3c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6F3C 16092 bytes
SHA-256: c6c28444bcd94379862b6cc7f8cfcdbcdaeb026857ccdb099d87626a561054a6
font_02_sfnt_off000083c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x83C9 7924 bytes
SHA-256: 0155b270e880695373dd54d4a603ab593a59502fdd82c9aa0432c78f0a40b4b7
font_03_sfnt_off00009e6c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9E6C 6444 bytes
SHA-256: 1957428794578a072b8983e864e5701b52391162abfb2d6d14c6295fa8a16687
font_04_sfnt_off0000adc2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xADC2 4372 bytes
SHA-256: 0342088d3df48d35ff21f1be6c615005ef378fc4fd0be0c98af7a96967da1f92

Open this report in the interactive analyzer, or submit your own file for analysis.