Malicious PDF — malware analysis report

Static analysis result for SHA-256 f168b95bd5faf8d0…

MALICIOUS

PDF

40.0 KB Authoring application: Adobe PDF Library 9.0 First seen: 2020-09-24
MD5: 870dd60405b98ce7aed5125b5ade9e3d SHA-1: bc430a1f3b6927a5044341937d0575f605828f0a SHA-256: f168b95bd5faf8d089bdf4cef83a0656080c54c078d6761f3fd4e4498f2bc5d9
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of a link farm or a phishing campaign designed to redirect users to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mentorconcrete.com/uploads/1/3/0/2/130289431/1818683.pdf In PDF document text
    • http://susanpultman.com/uploads/1/3/0/2/130291355/denejekujepaxe_jewatovitobimaw_kuresipuke_vepuponulo.pdfIn PDF document text
    • http://missfass.com/uploads/1/3/0/2/130288301/gazaneguran-zimivomi-durorefi-xovowabavonawe.pdfIn PDF document text
    • http://krazy-verns-carwash.com/uploads/1/3/0/6/130639805/dorawuno.pdfIn PDF document text
    • http://comecleandetail.com/uploads/1/3/0/5/130551991/70fb7d6eb05.pdfIn PDF document text
    • http://aeropac.vip/uploads/1/3/0/5/130538902/230867.pdfIn PDF document text
    • http://novelendings.com/uploads/1/3/0/8/130814408/1501964.pdfIn PDF document text
    • http://ssuvhsg.ch/uploads/1/3/0/3/130379674/4057968.pdfIn PDF document text
    • http://willslachance.com/uploads/1/3/0/2/130270837/6402334e13fbb88.pdfIn PDF document text
    • http://practicalstartupbook.net/uploads/1/3/0/6/130620847/552045.pdfIn PDF document text
    • http://gold-etf-losses.com/uploads/1/3/0/8/130874042/vuwogerobalogixaj.pdfIn PDF document text
    • http://kirillian.net/uploads/1/3/0/2/130289797/momazemiruzuf.pdfIn PDF document text
    • http://sylteszeri.com/uploads/1/3/0/7/130775259/gowoduxi.pdfIn PDF document text
    • http://lakehomemag.com/uploads/1/3/0/6/130639511/losiseretupoxetone.pdfIn PDF document text
    • http://winewiseidaho.com/uploads/1/3/0/7/130775990/zadop.pdfIn PDF document text
    • http://shakti-circus.com/uploads/1/3/0/5/130543190/sitapokipizetaxekiko.pdfIn PDF document text
    • http://mooreinnovation.org/uploads/1/3/0/7/130740212/nesubadut.pdfIn PDF document text
    • http://tcsonline.net/uploads/1/3/0/5/130551777/130551777.html#trastorno+de+ansiedad+con+agorafobia+dsm+vIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003e5c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3E5C 8920 bytes
SHA-256: c466b9ab3ecba56026cd0e568295cbabceaa24686df1c62eaeec076b5c36c5c5

Open this report in the interactive analyzer, or submit your own file for analysis.