Malicious PDF — malware analysis report

Static analysis result for SHA-256 ee0dea11ace955d7…

MALICIOUS

PDF

44.3 KB Authoring application: Mobipocket Creator First seen: 2020-09-24
MD5: ee873987564059969ee94f3317954ef7 SHA-1: 0130ae9966975fe3d10bd47fba5bc924a26da8d9 SHA-256: ee0dea11ace955d746797633ca9f03ff48de682434085d7a1bea411452e3c00b
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, many of which point to other PDF files hosted on various domains. The heuristic 'SE_URGENCY_LURE' indicates the document text likely contains language designed to create a sense of urgency. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The primary attack pattern involves luring the user to click on one of the embedded links, which likely leads to further malicious content or downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://universalfrequencies.com/uploads/1/3/0/6/130621775/taziwexegepipe-molekatul-jigavinuwobupe-mowuzipemigop.pdf In PDF document text
    • http://dpaulart.com/uploads/1/3/0/4/130476158/pazux.pdfIn PDF document text
    • http://discoveryislandschamber.com/uploads/1/3/0/2/130272365/jixizim-doxabelozob.pdfIn PDF document text
    • http://jordanlosesweight.com/uploads/1/3/0/6/130605104/7331336.pdfIn PDF document text
    • http://yincaravana.com/uploads/1/3/0/4/130490584/38d1b.pdfIn PDF document text
    • http://islamicfinancenorthamerica.com/uploads/1/3/0/4/130436362/kolirigaxikurex.pdfIn PDF document text
    • http://yolozwolle-lekkerpuh.nl/uploads/1/3/0/6/130639220/zibuwaju.pdfIn PDF document text
    • http://thehnossaproject.com/uploads/1/3/0/3/130379814/130379814.html#firebase+analytics+android+eventsIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011ed.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11ED 9000 bytes
SHA-256: 5bc16b34cd234b93743e648c26d2ab0b33a32300ad8843932e12037812479d72
font_01_sfnt_off00006719.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6719 16096 bytes
SHA-256: 65ca2fa633a49bc637c245e3469a24bec82cbb291b9200d770c42ee2df1588ac

Open this report in the interactive analyzer, or submit your own file for analysis.