Malicious PDF — malware analysis report

Static analysis result for SHA-256 f7727491f395ab60…

MALICIOUS

PDF

87.0 KB Authoring application: Inkscape First seen: 2020-09-24
MD5: 03eb46daa149065b445d5c9e7c2ed83f SHA-1: a2ce2b6480293ebfbe9b1b5a6bc280206ad12578 SHA-256: f7727491f395ab60e09aababd198a64e1aff5cd82a6d0cedb3271423af667ad4
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass external link farm pointing to numerous PDF files, a technique often used for SEO poisoning or to distribute malicious content. The heuristic 'SE_ADVANCE_FEE_SCAM_LURE' strongly indicates the document's purpose is to trick users with a fake lottery or prize notification, a common advance-fee fraud. The ClamAV detection further confirms its malicious nature. The embedded URLs are likely part of this scam, directing users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://privasack.com/uploads/1/3/0/3/130323469/lowefenod_mejewetopajun.pdf In PDF document text
    • http://momentumdanceandfit.com/uploads/1/3/0/6/130604568/8589367.pdfIn PDF document text
    • http://mail.keramaris.gr/uploads/1/3/0/8/130874635/2592986.pdfIn PDF document text
    • http://www.amysanchezbennett.com/uploads/1/3/0/3/130379314/faxab.pdfIn PDF document text
    • http://mta-sts.mail.slimacademy.at/uploads/1/3/0/5/130588943/23f50eaf3e4e043.pdfIn PDF document text
    • http://mikemooers.com/uploads/1/3/0/6/130639406/tuwonagorigonuze.pdfIn PDF document text
    • http://londonsalesagency.com/uploads/1/3/0/6/130605203/8135dd0a.pdfIn PDF document text
    • http://animators.directory/uploads/1/3/0/3/130323236/7810729.pdfIn PDF document text
    • http://lunchboxcafeny.com/uploads/1/3/0/4/130489157/193afbd561e.pdfIn PDF document text
    • http://livingthings.co/uploads/1/3/0/5/130544072/02c39.pdfIn PDF document text
    • http://www.kimbescorner.com/uploads/1/3/0/6/130603937/5008232.pdfIn PDF document text
    • http://morethanfood.net/uploads/1/3/0/5/130543020/feduvixifaxajow.pdfIn PDF document text
    • http://smithandbyford.net/uploads/1/3/0/2/130272506/c83ab.pdfIn PDF document text
    • http://thecontactlensinstitute.com/uploads/1/3/0/4/130476873/8679569.pdfIn PDF document text
    • http://thesecrettohealthyliving.com/uploads/1/3/0/5/130588515/gosedewejepiperefowu.pdfIn PDF document text
    • http://trkscamps101.club/uploads/1/3/0/6/130621437/54d1c6b5df1147.pdfIn PDF document text
    • http://cnichollswriting.com/uploads/1/3/0/6/130640183/ripawozowabovub_jadid_wamixafomirorib_vaxedim.pdfIn PDF document text
    • http://200jobs.com/uploads/1/3/0/5/130551765/nanolu_guvexomopak.pdfIn PDF document text
    • http://mta-sts.jackiedoesntknowcrap.com/uploads/1/3/0/5/130540211/2cd713bec01.pdfIn PDF document text
    • http://webmail.stemstil.nl/uploads/1/3/0/5/130540214/3675475.pdfIn PDF document text
    • http://nicolasintheoldmarket.com/uploads/1/3/0/7/130775251/devozu.pdfIn PDF document text
    • http://dwmfoundation.org/uploads/1/3/0/6/130603943/3937589.pdfIn PDF document text
    • http://mombligation.net/uploads/1/3/0/6/130620747/sinogut-nijevipovozebaz-sedukuvimo.pdfIn PDF document text
    • http://ripperwebsolutions.com/uploads/1/3/0/4/130491418/746fec61b5.pdfIn PDF document text
    • http://chaddock-family.rominastiebenphotography.com/uploads/1/3/0/6/130621481/130621481.html#agency+problem+theory+pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004c14.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4C14 9412 bytes
SHA-256: 64fc5b987ea0610707a67d642e28fb4b49a25a1a52df15ef48f73570506e24ee
font_01_sfnt_off00011057.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11057 16060 bytes
SHA-256: b080e6aa9682ff87567a230b404ab00780bafcfd3ba11e3f536b788ca6e08ef5

Open this report in the interactive analyzer, or submit your own file for analysis.