Malicious PDF — malware analysis report

Static analysis result for SHA-256 ed2eeb3664dc1b42…

MALICIOUS

PDF

42.5 KB Authoring application: PDF Studio First seen: 2020-09-24
MD5: a088dcec69c8915ad50129ce62baf6ed SHA-1: 2e114127bf9ef1f3c4a123976a27b64b8e93a056 SHA-256: ed2eeb3664dc1b42a23ddc813af382a74b8163f50d06ea171c08a31aa37e74e9
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a link farm with numerous embedded URLs, indicating a phishing or malware distribution attempt. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests malicious intent. The document body also contains a deceptive call-to-action phrase, further supporting the phishing lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rainbowsprinklescupcakery.com/uploads/1/3/0/6/130621597/sixeziloda.pdf In PDF document text
    • http://san69.com/uploads/1/3/0/6/130639648/f49abe.pdfIn PDF document text
    • http://ololparish.org/uploads/1/3/0/6/130639790/180155.pdfIn PDF document text
    • http://rentapartmani.com/uploads/1/3/0/6/130622005/sonopuxitutosewo.pdfIn PDF document text
    • http://noboysbeauty.com/uploads/1/3/0/5/130539936/6724114.pdfIn PDF document text
    • http://retavoz.piterlife-78.ru/uploads/2020/01/28/dibawes.pdfIn PDF document text
    • http://readwritebake.com/uploads/1/3/0/5/130590371/wefujanofewu.pdfIn PDF document text
    • http://watersidersnbpt.com/uploads/1/3/0/4/130490609/5501756.pdfIn PDF document text
    • http://thepenetwork.com/uploads/1/3/0/4/130475936/deteralekom-koroxupojiwafog-kofefej.pdfIn PDF document text
    • http://neokundalini.org/uploads/1/3/0/6/130603756/130603756.html#buddhism+a+very+short+introduction+pdfIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011cb.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11CB 7876 bytes
SHA-256: a904c2fbcc563b0f71a148ed4ad5ef8730a75bad5d1f13257c45cb2f531fc6e2

Open this report in the interactive analyzer, or submit your own file for analysis.