Malicious PDF — malware analysis report

Static analysis result for SHA-256 f1e666cec806e2b3…

MALICIOUS

PDF

42.2 KB Authoring application: Adobe PDF Library 9.0 First seen: 2020-09-24
MD5: 446870e4bafda1fa7f586c39a4672dc4 SHA-1: f88d92c36120ca1447c6ec6055f6528e41c39425 SHA-256: f1e666cec806e2b35aaa55a6922145d92eff0f6b4a43ea51999cf8e65f082706
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or SEO poisoning attack, aiming to redirect users to potentially malicious content hosted on various domains. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports the malicious intent. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tutorvirginia.com/uploads/1/3/0/6/130621897/39c9332b.pdf In PDF document text
    • http://teestressrelief.com/uploads/1/3/0/7/130775704/5386588.pdfIn PDF document text
    • http://monkonmolokai.com/uploads/1/3/0/2/130271082/gimunanafi.pdfIn PDF document text
    • http://julesjourneys.net/uploads/1/3/0/2/130274376/wenageti-jufuwed-ledasetim-norepupoba.pdfIn PDF document text
    • http://apietrantoni.com/uploads/1/3/0/2/130287890/zefijusijegonun.pdfIn PDF document text
    • http://m40925.com/uploads/1/3/0/5/130590583/1203768.pdfIn PDF document text
    • http://bouncybako.com/uploads/1/3/0/7/130776672/dizovotiribon-kidikekemo-jigimugada-zutorogis.pdfIn PDF document text
    • http://plataformaciudadana.net/uploads/1/3/0/6/130604144/3746821.pdfIn PDF document text
    • http://ansepacceleration.net/uploads/1/3/0/7/130739253/raxevirujuva.pdfIn PDF document text
    • http://americanbeachphoto.com/uploads/1/3/0/6/130620813/9b3e78933be.pdfIn PDF document text
    • http://krugmanwasright.com/uploads/1/3/0/4/130490250/5ec4ca3e9ba0ee.pdfIn PDF document text
    • http://mrbcontructionllc.com/uploads/1/3/0/7/130739153/lobudog.pdfIn PDF document text
    • http://christinacarnesphotography.com/uploads/1/3/0/5/130544070/3233957.pdfIn PDF document text
    • http://kateshawauthor.com/uploads/1/3/0/5/130540083/60d05c6b1.pdfIn PDF document text
    • http://mail.chicagopcc.com/uploads/1/3/0/2/130287529/6cb2a5d1a36.pdfIn PDF document text
    • http://sunshinepics.net/uploads/1/3/0/7/130776054/9b7339b8b3.pdfIn PDF document text
    • http://www.mediaturbo.org/uploads/1/3/0/7/130775531/69b82858c2.pdfIn PDF document text
    • http://jhsassociatesinc.com/uploads/1/3/0/5/130588529/d0a8321922.pdfIn PDF document text
    • http://tomsalf.store/uploads/1/3/0/2/130288731/kiriwuziti.pdfIn PDF document text
    • http://pocketultrasounds.com/uploads/1/3/0/3/130379429/kejebixitigaloriso.pdfIn PDF document text
    • http://web-design.creps-inc.jp/uploads/1/3/0/7/130740250/1f028de528e22ef.pdfIn PDF document text
    • http://ulcergardforhorses.com/uploads/1/3/0/4/130488311/bc9cff8.pdfIn PDF document text
    • http://flatearthgathering.org/uploads/1/3/0/8/130813511/2b09a674b0b.pdfIn PDF document text
    • http://authorkirstyferguson.com/uploads/1/3/0/7/130738706/kuxogeterub_zakozikut.pdfIn PDF document text
    • http://trust-trade.net/uploads/1/3/0/2/130289610/451590.pdfIn PDF document text
    • http://74-123-72-13.mgwnet.com/uploads/1/3/0/2/130270813/130270813.html#ac750+wireless+dual+band+gigabit+router+model+no.+archer+c2In PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002ec0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x2EC0 4236 bytes
SHA-256: d5ed1c3e32e121bc7fdf4b7f64e9f52042883cdc8d0b4eb1f0c73bff7e2be32e
font_01_sfnt_off00003ec8.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3EC8 8556 bytes
SHA-256: 484cf8db97dd2db29b91b8859068a09c503901c55c988125938cc73146a03244

Open this report in the interactive analyzer, or submit your own file for analysis.