Malicious PDF — malware analysis report

Static analysis result for SHA-256 eae427745de38733…

MALICIOUS

PDF

39.4 KB Authoring application: QPDF First seen: 2020-09-07
MD5: 41fe8e0256f0efa82a511e96ad7c0743 SHA-1: 21deca3010c7f9e1d2e7092f75fae554a0c92f2b SHA-256: eae427745de38733428302e319547fcf53dedd1908584293c446a399e61fb230
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF files, a technique commonly used for SEO spam or to redirect users to malicious sites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-driving intent. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://girlfriendsfitnessparsons.com/uploads/1/3/0/7/130739396/f9f039c7f294d.pdf In PDF document text
    • http://iothinqs.com/uploads/1/3/0/5/130589423/ruruxes.pdfIn PDF document text
    • http://itldo.net/uploads/1/3/0/2/130289523/da5b59bc41a43.pdfIn PDF document text
    • http://nilakim.com/uploads/1/3/0/7/130775219/vazitazev.pdfIn PDF document text
    • http://northstarbees.com/uploads/1/3/0/4/130483397/xipumasabatuz.pdfIn PDF document text
    • http://sex888.site/uploads/1/3/0/4/130478433/bataxotuvusovirati.pdfIn PDF document text
    • http://mta-sts.mail.livestyliv.com/uploads/1/3/0/7/130739763/fedofu.pdfIn PDF document text
    • http://hostmaster.vonalten.com/uploads/1/3/0/2/130272319/xadekikobova_gegupal_nifiguxekujame.pdfIn PDF document text
    • http://mkh-mfg.com/uploads/1/3/0/5/130550871/6ad1221203c9d6.pdfIn PDF document text
    • http://bsstudio.virtus.hu/uploads/1/3/0/7/130740349/7666282.pdfIn PDF document text
    • http://printeneur.com/uploads/1/3/0/6/130603834/9201d4.pdfIn PDF document text
    • http://abimanyuvillasbali.com/uploads/1/3/0/8/130814851/63faaaf.pdfIn PDF document text
    • http://blackbeardmarketing.com/uploads/1/3/0/7/130740551/gakiv.pdfIn PDF document text
    • http://electdavidharris.com/uploads/1/3/0/5/130550742/tirodamuxinij.pdfIn PDF document text
    • http://jodigardnermakeup.com/uploads/1/3/0/7/130776886/geworebotizugipaki.pdfIn PDF document text
    • http://townofclermont.com/uploads/1/3/0/7/130776102/bonoporapujit-rejama.pdfIn PDF document text
    • http://www.kontentsu.co/uploads/1/3/0/7/130775478/e21379747c3ad9d.pdfIn PDF document text
    • http://jamesleachfineart.com/uploads/1/3/0/5/130550848/42e2e975cb.pdfIn PDF document text
    • http://onlygodcanjudgeus.com/uploads/1/3/0/5/130539370/balutag-pujotevol-xidugu.pdfIn PDF document text
    • http://backroadsbestclub.store/uploads/1/3/0/6/130604918/lepirejewex.pdfIn PDF document text
    • http://electxt.com/uploads/1/3/0/2/130289493/vosajebasobuf-vajilo.pdfIn PDF document text
    • http://bshppopup.com/uploads/1/3/0/2/130291646/130291646.html#dupilumab+fda+approval+ageIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d96.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2D96 2724 bytes
SHA-256: 6f8a11d1ccf7eba94b25f6f7db5f968d10182086c6a129b27029ae30668dc5cf
font_01_sfnt_off00003998.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3998 7832 bytes
SHA-256: 0df738655e69ca6b450c9e2139eb415adfdb029db88ed429efe4f5be48b0611b

Open this report in the interactive analyzer, or submit your own file for analysis.