Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe5ae566b1dd97c5…

MALICIOUS

PDF

46.3 KB Authoring application: Adobe PDF Library 9.0 First seen: 2020-09-24
MD5: 1e50df940091c9293806de2ac6497e4a SHA-1: 2374f692f36d78bdc9e9533de4f166a542e1ddf8 SHA-256: fe5ae566b1dd97c59044ef4acdabeaa9238af266bdca4a317a2a5408936807fa
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also flag this file as malicious. The primary attack pattern appears to be a link farm designed to direct users to potentially malicious content hosted on various domains. No scripts were extracted, limiting the analysis of direct execution capabilities.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://propertymanagerfinder.com/uploads/1/3/0/6/130639368/5842540.pdf In PDF document text
    • https://bowofanamuxedik.weebly.com/uploads/1/3/0/4/130488181/sufelunuri-saweduzi-xogozib-xovurewarapu.pdfIn PDF document text
    • http://alloexo.solutions/uploads/1/3/0/3/130313015/1298976.pdfIn PDF document text
    • http://beyondcleanmaids.ca/uploads/1/3/0/6/130622104/ebece76df3206.pdfIn PDF document text
    • http://missgojo.com/uploads/1/3/0/6/130621300/4553180.pdfIn PDF document text
    • http://arcmowercounty.org/uploads/1/3/0/5/130588289/4d93f16871ef.pdfIn PDF document text
    • http://mybestloanrate.com/uploads/1/3/0/6/130620919/xawep.pdfIn PDF document text
    • http://runiz.nikulin-ildar.ru/uploads/2020/01/29/zurumoxazemu.pdfIn PDF document text
    • http://pwilliamstein.weebly.com/uploads/1/3/0/2/130289319/vininizof_xunodelu_gijuraji.pdfIn PDF document text
    • http://jejaxedik.danheat-sunrain.ru/uploads/2020/01/27/2fcf8b1e9155.pdfIn PDF document text
    • https://mebiduniriza.weebly.com/uploads/1/3/0/3/130323552/gaguvuz.pdfIn PDF document text
    • https://ralukulavezekus.weebly.com/uploads/1/3/0/4/130476687/ab8157.pdfIn PDF document text
    • http://2020blue.org/uploads/1/3/0/3/130313336/130313336.html#android+version+users+statistics+2019In PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 6

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001366.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1366 8244 bytes
SHA-256: d06ed3e840f0437f30f17a68c5d40119c529d3ea5182b1de625dcf689abac11e
font_01_sfnt_off00007a0e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7A0E 2732 bytes
SHA-256: da6e935b6a97a045a0c5629c3666d6f53d7c870963c8d55116ca0c7eba84cbf8

Open this report in the interactive analyzer, or submit your own file for analysis.