Malicious PDF — malware analysis report

Static analysis result for SHA-256 fcd0a1dcf3e84c2d…

MALICIOUS

PDF

46.0 KB Authoring application: Pdftk First seen: 2020-09-07
MD5: 9ce937385d2c7af2db06602ff8afed66 SHA-1: 9d3568666af08b825b2085e251606812161ba81d SHA-256: fcd0a1dcf3e84c2dd34b520c63a735e64d1a57e6384713d7ed0bbb96ed26bac0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to other PDF files, indicating a link farm designed to distribute malicious content. ClamAV detected this as Pdf.Phishing.TtraffRobotInstall, and the ML classifier also flagged it as malicious. The primary attack pattern involves luring users to download further malicious PDFs.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mta-sts.tangns.ie/uploads/1/3/0/7/130739120/7be51b.pdf In PDF document text
    • http://mywashcard.ca/uploads/1/3/0/5/130590482/nokop.pdfIn PDF document text
    • http://stavangerfitness.com/uploads/1/3/0/4/130483581/7672274.pdfIn PDF document text
    • http://cherryhilllawncare.com/uploads/1/3/0/7/130775950/povevewupoj.pdfIn PDF document text
    • http://dreamfinancial.com.au/uploads/1/3/0/4/130476511/bda9c.pdfIn PDF document text
    • http://onefootcandle.com/uploads/1/3/0/6/130604152/85269560.pdfIn PDF document text
    • http://springvalleyvillagearborist.com/uploads/1/3/0/6/130639535/63164f.pdfIn PDF document text
    • http://zimpresos.com/uploads/1/3/0/6/130621005/lupazuwimokunevi.pdfIn PDF document text
    • http://sheilastonephotographer.com/uploads/1/3/0/4/130488429/rumelomexidolowamo.pdfIn PDF document text
    • http://thepentaxpioneer.com/uploads/1/3/0/2/130274017/7872738.pdfIn PDF document text
    • http://alseptumweb.com/uploads/1/3/0/8/130813730/39c496133.pdfIn PDF document text
    • http://judithjack.com/uploads/1/3/0/7/130738974/5228817.pdfIn PDF document text
    • http://web5.pleasingfood.com/uploads/1/3/0/7/130738859/130738859.html#acne+vulgaris+ppt+slideshareIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://fontawesome.iohttp://fontawesome.io/license/In PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004629.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4629 2860 bytes
SHA-256: 4d9ec2aec8f1ca6bebe1b56492fd55a77bba3a6e98efb76508c1b835d4eb9912
font_01_sfnt_off00004fa1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4FA1 2008 bytes
SHA-256: 887f302533a294d63c033f0828492d7658a9d17f775992f408881f7845df32c9
font_02_sfnt_off00005b7b.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x5B7B 8144 bytes
SHA-256: 9095071b5a503a5716d99c8ce11aa2323bad59232d8e847992c0ba842a354ecc

Open this report in the interactive analyzer, or submit your own file for analysis.