Malicious PDF — malware analysis report

Static analysis result for SHA-256 f165de51b8bf11a3…

MALICIOUS

PDF

42.6 KB Authoring application: PDFBox First seen: 2020-09-24
MD5: b8f717b286590dfe89ff583430903270 SHA-1: f7610674244898b0a50ee432277a2865da523cf8 SHA-256: f165de51b8bf11a33838ee6dea33d875dcc38cfb94f37ba9a2a46dcd58b424e3
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF was flagged by ClamAV as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and a machine learning classifier indicated a high probability of maliciousness. Static analysis revealed a large number of embedded external links pointing to PDF files hosted on various domains, suggesting a link farm or redirection scheme. The document body, though heavily obfuscated, contains text related to 'aadhaar address update', which could be a lure for phishing or credential harvesting. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.sandranewtontextiles.com/uploads/1/3/0/2/130272083/gaxexigizilarufaguk.pdf In PDF document text
    • http://bridgecrowdfunding.com/uploads/1/3/0/3/130313127/3c3439d9be6.pdfIn PDF document text
    • http://bumbleandsprout.com/uploads/1/3/0/7/130775056/95e2d39753b27c8.pdfIn PDF document text
    • http://www.melbournebasketballacademy.com/uploads/1/3/0/5/130550859/xoziniruj_kujinigaw_miselar.pdfIn PDF document text
    • http://dandylyonz.com/uploads/1/3/0/9/130969231/47124.pdfIn PDF document text
    • http://susansgardenminipigs.com/uploads/1/3/0/2/130271087/5997312.pdfIn PDF document text
    • http://fatsom.com/uploads/1/3/0/3/130313671/pofunibasanoji.pdfIn PDF document text
    • http://enem2022.com/uploads/1/3/0/4/130488615/3300244.pdfIn PDF document text
    • http://collegeworksestimate.com/uploads/1/3/0/5/130550664/zuworuzexigidi-kevedapuwebo-gefupaj-jifiderek.pdfIn PDF document text
    • http://ruthbavetta.com/uploads/1/3/0/4/130488946/kedimazabemavozus.pdfIn PDF document text
    • http://metavoia.com/uploads/1/3/0/2/130289557/lezogugidipota-lufaxe-xidozepasuxu-verufolive.pdfIn PDF document text
    • http://7q7me.slpny.com/uploads/1/3/0/3/130313366/130313366.html#list+of+documents+for+aadhaar+address+updateIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
🗂 Part of campaign: fatsom.com 7 samples

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003d8b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3D8B 6584 bytes
SHA-256: 2ded84b6949b4d1692508e51ab88c0457cd7e0e230c903009693882a3be47fd5
font_01_sfnt_off000050b2.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x50B2 7468 bytes
SHA-256: b59c89873d8dfbfabb4d8b21abaaf824b7caf1c8af02c7f4e85d4ba974e6d240

Open this report in the interactive analyzer, or submit your own file for analysis.