Malicious PDF — malware analysis report

Static analysis result for SHA-256 f80f3dfdd555f97e…

MALICIOUS

PDF

50.2 KB Authoring application: Nitro PDF First seen: 2020-09-24
MD5: 5591a0ff925aa89a544ab23799b56d92 SHA-1: a8426b70323784daf8f5758f72bfe428bcf41d60 SHA-256: f80f3dfdd555f97e345eace8f5ceb43f92c6cb6913e6e16c794e9aef2d992d3c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs, forming a link farm. This is indicative of SEO manipulation or a phishing lure, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tricitytaxi.net/uploads/1/3/0/2/130289569/a2fea30.pdf In PDF document text
    • http://oilsfortriathletes.com/uploads/1/3/0/3/130323511/punibemizumimo_famiguf.pdfIn PDF document text
    • http://vwear.net/uploads/1/3/0/6/130621530/5382668.pdfIn PDF document text
    • http://mail.light2germany.com/uploads/1/3/0/8/130813357/sonogebota.pdfIn PDF document text
    • http://dentistmanalapannj.com/uploads/1/3/0/5/130541743/lojuzerivi-vopowabolewudup-meruboziloz.pdfIn PDF document text
    • http://orumalayalamdiary.com/uploads/1/3/0/6/130639534/jexironanejaben-jazuforif-rotimurexuvipap-tumasoga.pdfIn PDF document text
    • http://www.rowenmatthews.com/uploads/1/3/0/7/130776060/c10e50a9f849.pdfIn PDF document text
    • http://engstrumphotography.com/uploads/1/3/0/5/130546283/gakogoga-womiwir.pdfIn PDF document text
    • http://themrmatt.com/uploads/1/3/0/6/130604425/484516.pdfIn PDF document text
    • http://webmail.raritanvalleybassmasters.com/uploads/1/3/0/7/130776425/metif-jijesuleje-gogiludisofi.pdfIn PDF document text
    • http://calgarybrokerageproposal.com/uploads/1/3/0/6/130639476/6c5c56fac3e9bd8.pdfIn PDF document text
    • http://888claim15.org/uploads/1/3/0/4/130475980/696509.pdfIn PDF document text
    • http://korish245.ru/uploads/1/3/0/3/130324350/fac1f900c4a7cb.pdfIn PDF document text
    • http://mikeshomepage.net/uploads/1/3/0/6/130604494/diwubikexedegur.pdfIn PDF document text
    • http://navasotaminerals.com/uploads/1/3/0/4/130489230/zazelemugaxasag_tojumiti_kesewidipile.pdfIn PDF document text
    • http://toolgratis.com/uploads/1/3/0/7/130775126/jekujirokatuz_lugiligiped.pdfIn PDF document text
    • http://knottypinewoods.com/uploads/1/3/0/7/130776366/b8a35.pdfIn PDF document text
    • http://9f62fcb300.com/uploads/1/3/0/2/130272414/vubegeterupa.pdfIn PDF document text
    • http://thebuttkickindietitian.com/uploads/1/3/0/8/130874329/f7e63ff77c3c.pdfIn PDF document text
    • http://distribuidoramaissaude.com/uploads/1/3/0/2/130270866/pepavig_xonafur.pdfIn PDF document text
    • http://cleviagrandfullsite.devsite-1.com/uploads/1/3/0/2/130272296/130272296.html#canonical+correlation+analysis+%28cca%29+in+rIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000040c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x40C1 16148 bytes
SHA-256: c715d70b655cc84612960fb88a4e12085ad92abfa9c7e55edaa865827c7872ae
font_01_sfnt_off0000559a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x559A 3076 bytes
SHA-256: 7fec1186382f34a5155dc6c248311be11c53bb1737067c31e8ccbb863d62d846
font_02_sfnt_off00006353.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6353 8240 bytes
SHA-256: 686da0dc37e1ad57f39b3d61e3e4d73fc1a7212f5c64984d2dcb003666c1b269

Open this report in the interactive analyzer, or submit your own file for analysis.