Malicious PDF — malware analysis report

Static analysis result for SHA-256 06370e01a003d9c2…

MALICIOUS

PDF

37.9 KB Authoring application: OpenOffice.org
MD5: 936c8d5f8b19a5e3cf329343f96bac2f SHA-1: 602df20f6ddeb48285c4e4bfb64c80d5c0f48fda SHA-256: 06370e01a003d9c23e95ce9e76549a80fd7e5eae7985bd64e95ddefd096222a6
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or distributing further malware. The embedded URLs are the primary IOCs, suggesting a link farm or redirection mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kelivafob.binancedex-giveaway.com/uploads/2020/01/29/3175170.pdf
    • http://durhamyouthprograms.org/uploads/1/3/0/6/130639506/328133.pdf
    • http://nuwage.net/uploads/1/3/0/6/130603889/9306533.pdf
    • http://netmotiondemo.com/uploads/1/3/0/3/130313069/3207401.pdf
    • https://lolijuxinu.weebly.com/uploads/1/3/0/4/130489172/c26ff4c84e74105.pdf
    • http://bovizit.vipiski-online8.icu/uploads/2020/01/29/fotowepodivu.pdf
    • http://upanaloriri.com/uploads/1/3/0/5/130539881/regenolodi-ziwutobasuvasur-talatuw-vevawitavip.pdf
    • http://badasspugclub.com/uploads/1/3/0/2/130287314/batevujezejaz.pdf
    • http://moodmetals.com/uploads/1/3/0/6/130604495/gimopexugekupu-fabegonimunin-bugijulom.pdf
    • http://siobhanartandecology.com/uploads/1/3/0/2/130291658/tanawax_rusegipixe_tazulafatazado.pdf
    • http://baumanntravels.com/uploads/1/3/0/4/130476050/togexubidituvej-wikenujuvuwu.pdf
    • http://pe-uae.com/uploads/1/3/0/6/130621149/xezoduzazitizexawe.pdf
    • http://morris-auto.com/uploads/1/3/0/4/130435753/potuzajivuruf.pdf
    • http://eidointernational.com/uploads/1/3/0/6/130639743/9268749.pdf
    • http://djdbaker.com/uploads/1/3/0/5/130545249/popagoxosulos.pdf
    • http://boje.darcis-ko.fun/uploads/2020/01/28/903eafbbae9.pdf
    • https://fozemanesafire.weebly.com/uploads/1/3/0/5/130546432/10bed7c864.pdf
    • http://lideresindustriales.com/uploads/1/3/0/3/130379412/ravizivugilogarawoju.pdf
    • http://jamabolex.megadrom.info/uploads/2020/01/28/7583881.pdf
    • http://127onyork.com/uploads/1/3/0/6/130620542/130620542.html#fractions+to+decimals+worksheets+year+6

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015fc.bin
bfca709bb021ffeb93aae0092011f8e59cd01ddaacc5457b8dcf5137a6c47ff0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15FC 8016 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.