Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8943dc643637f93…

MALICIOUS

PDF

47.1 KB Authoring application: Nitro PDF First seen: 2020-08-10
MD5: b483b3943cdbdf9bf2724ea097695c3a SHA-1: eec78d40b3e21e5b7cc80909e49845a95455a955 SHA-256: f8943dc643637f934c92016231dc2615096eb019901802ffd79cf6aebb8f34cc
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The PDF_SEO_LINK_FARM heuristic indicates a large number of embedded external links, with the first being http://dondealmuerzo.com/uploads/1/3/0/6/130605351/1246889.pdf. This suggests the document's primary purpose is to act as a lure, directing users to potentially malicious content hosted on these external sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dondealmuerzo.com/uploads/1/3/0/6/130605351/1246889.pdf In PDF document text
    • http://suwotuwo.go-new.xyz/uploads/2020/01/28/269700.pdfIn PDF document text
    • https://jemejagukop.weebly.com/uploads/1/3/0/5/130590265/mimesuwelibaka.pdfIn PDF document text
    • http://dipagnu.com.br/uploads/1/3/0/6/130603859/rarijosepotalo.pdfIn PDF document text
    • http://kickingitwithchrist.com/uploads/1/3/0/3/130379174/9022396.pdfIn PDF document text
    • http://mountainviewconcreteco.com/uploads/1/3/0/2/130271161/4716732.pdfIn PDF document text
    • http://socialchangemarketplace.com/uploads/1/3/0/5/130550929/62291bfcc3.pdfIn PDF document text
    • http://obxaerialads.com/uploads/1/3/0/5/130590410/2702000.pdfIn PDF document text
    • https://xuwelovewavopiw.weebly.com/uploads/1/3/0/2/130272071/baneduxosa.pdfIn PDF document text
    • http://wubewiluse.srpautomotrestucuman.com/uploads/2020/01/27/loregopujaman.pdfIn PDF document text
    • http://shelleyortner.com/uploads/1/3/0/4/130488198/ravuxajezulupes-tedodonatiw.pdfIn PDF document text
    • http://mindstate.store/uploads/1/3/0/4/130476243/laripugubudena.pdfIn PDF document text
    • http://newleaf-dayspa.com/uploads/1/3/0/2/130270980/7575197.pdfIn PDF document text
    • http://divinedesign.biz/uploads/1/3/0/6/130605421/dadupa_wixegis.pdfIn PDF document text
    • http://tisat.turnrun.fun/uploads/2020/01/27/b8c2a.pdfIn PDF document text
    • http://zotakorosi.oftsinwiltit.pro/uploads/2020/01/27/1243656.pdfIn PDF document text
    • http://mindfulevolution.net/uploads/1/3/0/2/130289172/xopivumi.pdfIn PDF document text
    • http://momentumlifecoach.org/uploads/1/3/0/6/130621714/130621714.html#3ds+max+2018+material+editorIn PDF document text
🗂 Part of campaign: shelleyortner.com 4 samples

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000151a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x151A 8448 bytes
SHA-256: dd96d601e1c3a093fec0578e136dd30e784c887b72ce8dcfe86a8536bedca4f6

Open this report in the interactive analyzer, or submit your own file for analysis.