Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8244865823c27af…

MALICIOUS

PDF

39.3 KB Authoring application: PDF Studio First seen: 2020-09-24
MD5: db60006e78ba137eee16073ef709e4ac SHA-1: abd659d555555674a14b562080000aedd3cc10f5 SHA-256: f8244865823c27af0bf48b3e3c9f050b4d7699d21ed294ed8700235ca240767f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document was flagged by multiple heuristics, including a critical alert for a large number of external links, indicating a link farm. The ML classifier also assigned a high probability of maliciousness. ClamAV identified the file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', suggesting a phishing or traffic redirection scheme. The embedded URLs are likely used to distribute further malicious content or lead users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://emilysapp.com/uploads/1/3/0/2/130272372/b56e30639bc54c7.pdf In PDF document text
    • http://74-123-77-175.mgwnet.com/uploads/1/3/0/7/130740163/d5c4ad82e4c.pdfIn PDF document text
    • http://liverocks.net/uploads/1/3/0/7/130739810/4603611.pdfIn PDF document text
    • http://queenalexandra78ave.com/uploads/1/3/0/7/130775969/vomuvuwoz_kunalomopo.pdfIn PDF document text
    • http://gogocake.com/uploads/1/3/0/4/130488395/4306530.pdfIn PDF document text
    • http://abcdts.store/uploads/1/3/0/5/130543052/761781.pdfIn PDF document text
    • http://selfsufficientteen.com/uploads/1/3/0/7/130775211/gumuri.pdfIn PDF document text
    • http://networkmarketingmalaysia.com/uploads/1/3/0/7/130776032/gevuzolowupug.pdfIn PDF document text
    • http://preludemusic.com.au/uploads/1/3/0/4/130490421/757b9789707a03.pdfIn PDF document text
    • http://abovetumblerridge.ca/uploads/1/3/0/6/130621413/0f8d5.pdfIn PDF document text
    • http://bodhibros.com/uploads/1/3/0/6/130639705/1dfbf6d44.pdfIn PDF document text
    • http://insituexperiences.com/uploads/1/3/0/5/130550790/c3f8572.pdfIn PDF document text
    • http://idobricks.com/uploads/1/3/0/4/130436258/monuxefe-dutami.pdfIn PDF document text
    • http://bangkokrepublik.co/uploads/1/3/0/4/130476045/maxepomugunud.pdfIn PDF document text
    • http://siberianpurrbabies.com/uploads/1/3/0/7/130775023/8483531.pdfIn PDF document text
    • http://encompasscre.com/uploads/1/3/0/4/130483757/9674769.pdfIn PDF document text
    • http://jazzislife.net/uploads/1/3/0/6/130604416/0a4b0.pdfIn PDF document text
    • http://laserlily.com/uploads/1/3/0/5/130590138/vubopaj-bifejumifamebel.pdfIn PDF document text
    • http://mmjplantation.org/uploads/1/3/0/5/130541424/mifavasukiveti_nobexe_ligejijira_nozubafe.pdfIn PDF document text
    • http://buy-cbd.shop/uploads/1/3/0/3/130379294/95cfd1.pdfIn PDF document text
    • http://cadescovejunkies.com/uploads/1/3/0/7/130775088/fubiwu-suwud-garem-mimibafuz.pdfIn PDF document text
    • http://www.fillmorefamilymedicalgroup.org/uploads/1/3/0/6/130603764/revukawes.pdfIn PDF document text
    • http://sellingonline.today/uploads/1/3/0/4/130436441/1461304.pdfIn PDF document text
    • http://whataboutsecondbreakfast.com/uploads/1/3/0/4/130476516/9449874.pdfIn PDF document text
    • http://oddlyspecificshirts.com/uploads/1/3/0/5/130543985/xinupaluwomexome.pdfIn PDF document text
    • http://74-123-77-90.mgwnet.com/uploads/1/3/0/5/130542780/130542780.html#despacito+piano+sheet+music+for+beginnersIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000344c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x344C 8996 bytes
SHA-256: 9a2631aed90e12d5446f38ff5368fa6dfbd65b194d12a3ae4380177fcfc47ecd

Open this report in the interactive analyzer, or submit your own file for analysis.