Malicious PDF — malware analysis report

Static analysis result for SHA-256 fa1c763f623f4eb0…

MALICIOUS

PDF

46.2 KB Authoring application: pstoedit First seen: 2020-09-24
MD5: d19527709911c354995de61599750db5 SHA-1: aad6b70c8800d4cfe2772e6e02142b07a71b7582 SHA-256: fa1c763f623f4eb0b86d77140e529279c144cf0549b177915f197236b15368d2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malicious content. ClamAV and an ML classifier identified this file as malicious, specifically as a phishing or robot-related installer. The document body is heavily obfuscated and unreadable, providing no further context on the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://squareonefurnishings.com/uploads/1/3/0/4/130489803/wadugibikin-dilutadubozogu.pdf In PDF document text
    • http://thetee-shirt-shack.com/uploads/1/3/0/7/130738837/pozewepefu.pdfIn PDF document text
    • http://lakegeorgebrewhouse.com/uploads/1/3/0/5/130539185/tawaxewekadipusiw.pdfIn PDF document text
    • http://albuquerquemobilenotary.com/uploads/1/3/0/2/130271017/vidateteg-gotupopu-makekixi.pdfIn PDF document text
    • http://macdonald-designs.com/uploads/1/3/0/6/130620272/padezojozolarexo.pdfIn PDF document text
    • http://rgdesigns.org/uploads/1/3/0/4/130489467/3c4c892e9f.pdfIn PDF document text
    • http://mkefacepaint.com/uploads/1/3/0/2/130273884/lalofebupi.pdfIn PDF document text
    • http://partywife.net/uploads/1/3/0/8/130873978/8a5b50b0.pdfIn PDF document text
    • http://magicsigma.com/uploads/1/3/0/2/130291545/foteraver.pdfIn PDF document text
    • http://brotherssoap.com/uploads/1/3/0/9/130969993/dejepegela-pukatoxal-juwes-mobovavewuda.pdfIn PDF document text
    • http://autumnweavesdecor.com/uploads/1/3/0/6/130621304/a933da.pdfIn PDF document text
    • http://jessethorn.com/uploads/1/3/0/2/130287296/6425714.pdfIn PDF document text
    • http://awaidallc.com/uploads/1/3/0/3/130323409/tiwazopibakewesud.pdfIn PDF document text
    • http://sonhab.com/uploads/1/3/0/6/130620669/kaxezamoragew_vugelogarul_tefozodi_gagaxigozuram.pdfIn PDF document text
    • http://cairobritishcollege.com/uploads/1/3/0/4/130478882/5dc37361f.pdfIn PDF document text
    • http://pillarsofart.com/uploads/1/3/0/7/130776239/68f177e328bd6.pdfIn PDF document text
    • http://streetwalkers.club/uploads/1/3/0/4/130483469/fe76e7ae.pdfIn PDF document text
    • http://ardmoreccc.org/uploads/1/3/0/5/130544954/bunazajexisesuk.pdfIn PDF document text
    • http://nicoleedwardslimited.com/uploads/1/3/0/2/130291800/6967954.pdfIn PDF document text
    • http://marpalaceportuguese.devsite-1.com/uploads/1/3/0/3/130313379/130313379.html#pre-intermediate+reading+comprehension+worksheets+pdfIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000034a0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x34A0 2684 bytes
SHA-256: 1b0b9ccafa3a8d4187e86757028d03de598065db96186c0e11ce259314def278
font_01_sfnt_off00003d8e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3D8E 16092 bytes
SHA-256: c6c28444bcd94379862b6cc7f8cfcdbcdaeb026857ccdb099d87626a561054a6
font_02_sfnt_off0000551c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x551C 8084 bytes
SHA-256: 4c09ac0cce00e6efc562ea9caa82ec2e04c7eb10bf7df294973db516f5919850

Open this report in the interactive analyzer, or submit your own file for analysis.