Malicious PDF — malware analysis report

Static analysis result for SHA-256 05c8bbb359bc1fde…

MALICIOUS

PDF

51.2 KB Authoring application: OpenOffice Draw
MD5: 465815f6a28124ba5dfcc2e02697fa63 SHA-1: 2619d6529ddf32eab8acfd5ffa4e9c00fd93e6a3 SHA-256: 05c8bbb359bc1fdea0ce44af49c422112c23727bb400dbb3646ac98f71cd6cf0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or distribute malicious content. The ML classifier and ClamAV detection further support its malicious nature, classifying it as phishing-related malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mochiecouture.com/uploads/1/3/0/5/130546880/7736047.pdf
    • http://terriguy.com/uploads/1/3/0/4/130476244/21248db.pdf
    • http://anneweisstherapy.com/uploads/1/3/0/4/130477420/d098b34c7.pdf
    • http://alaskafoodie.info/uploads/1/3/0/6/130639583/f2e1d2e7f.pdf
    • http://florendostudioarts.com/uploads/1/3/0/7/130738603/2971140.pdf
    • http://www.mohnayminks.com/uploads/1/3/0/2/130288006/nuvisabozifak-pefifev-zefunare-fojuzaniwedegun.pdf
    • http://aliciashouse.net/uploads/1/3/0/4/130435842/df061e5e3c3.pdf
    • http://leftback.co.uk/uploads/1/3/0/2/130288506/vediw.pdf
    • http://mydenson.com/uploads/1/3/0/2/130270911/voxifenaborebipedufo.pdf
    • http://levelupintuition.com/uploads/1/3/0/7/130738512/tisel.pdf
    • http://calgarymobileiv.com/uploads/1/3/0/3/130323755/b419d10f.pdf
    • http://emergworld.com/uploads/1/3/0/6/130639563/kitewijaroz-jedonumutejo-pususivagom.pdf
    • http://monetki.website/uploads/1/3/0/3/130313243/fbd10.pdf
    • http://nowhiringheroes.net/uploads/1/3/0/5/130590164/kabineguxamek_wajufaridodavaj.pdf
    • http://se8ed.com/uploads/1/3/0/5/130588394/pesapisarutug.pdf
    • http://plussizebridesmaiddressesmassachusetts.com/uploads/1/3/0/7/130738765/4157128.pdf
    • http://servereserves.com/uploads/1/3/0/2/130270743/belobozubo.pdf
    • http://nordicwarriortraining.com/uploads/1/3/0/5/130545932/9d8b97.pdf
    • http://bootstrappingbetty.com/uploads/1/3/0/5/130543320/vivobakuwegoral_rogepepelusewa_ginasadu_bozoli.pdf
    • http://cameliascandles.org/uploads/1/3/0/6/130603929/825dacf65c.pdf
    • http://host121.carmichaelnl.com/uploads/1/3/0/6/130639839/130639839.html#acids+bases+and+salts+for+class+10+cbse+notes+pdf+download
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000045d3.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea
pdf-font-stream PDF embedded font (sfnt) at offset 0x45D3 2652 bytes
font_01_sfnt_off00004eaf.bin
196cba584dcff683a9a17900749c0f15e5052d8a4a72954217c1a4a90e817cfe
pdf-font-stream PDF embedded font (sfnt) at offset 0x4EAF 16088 bytes
font_02_sfnt_off00006664.bin
0cd8251b48c944d265d1eeb9d5ee6522f42f36f14ab0f0406e7d40e6ac06e651
pdf-font-stream PDF embedded font (sfnt) at offset 0x6664 8580 bytes