Malicious PDF — malware analysis report

Static analysis result for SHA-256 06fe198fcb5e6497…

MALICIOUS

PDF

47.5 KB Authoring application: OpenOffice Draw
MD5: e1b76acb716f5dd0dc3826dad55b4cce SHA-1: f0c1ce7b212c5f56c79426701aaddb70a1fbf229 SHA-256: 06fe198fcb5e6497da629c7d548104a95937b262675ba18f42d562563dce3958
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO spam or to distribute further malicious content. ClamAV and ML classifiers also flagged this file as malicious, specifically identifying it as a phishing or traffic-generating PDF. No scripts were extracted, but the extensive link farm suggests a malicious intent to redirect users.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://schooldietology.space/uploads/1/3/0/4/130488584/vaxurotin.pdf
    • http://etomolagi.com/uploads/1/3/0/6/130604539/8513459.pdf
    • http://columbushardscapes.com/uploads/1/3/0/4/130477448/dekiwove.pdf
    • http://quotes-n-quips.com/uploads/1/3/0/6/130639706/ba5dbbf7a186b7.pdf
    • http://repuestosmedicos.com/uploads/1/3/0/6/130620272/1538438.pdf
    • http://333diamondwholesale.com/uploads/1/3/0/4/130483937/1245926.pdf
    • http://zaneholm.com/uploads/1/3/0/6/130640119/60be2f86ba17391.pdf
    • http://5stardist.com/uploads/1/3/0/7/130775131/pidabirutapuf.pdf
    • http://the-real-estate-sisters.com/uploads/1/3/0/2/130272586/ziwiretet.pdf
    • http://summitphotographer.com/uploads/1/3/0/5/130550706/fafedanalutu.pdf
    • http://stuffstories.org/uploads/1/3/0/2/130271090/xigaseruwi.pdf
    • http://pitchstock.net/uploads/1/3/0/7/130739878/lirevi.pdf
    • http://contemporarypublishing.com/uploads/1/3/0/5/130550985/jetibowiwid-rugituperavigir-rewujejo-waliwamifivev.pdf
    • http://pellipandiri.com/uploads/1/3/0/3/130323208/cd4c25da273d.pdf
    • http://www.barnesculinarycompany.com/uploads/1/3/0/2/130271219/kesuv_xozudid_kinunezojav.pdf
    • http://alabamaassure.com/uploads/1/3/0/6/130605448/ninawomokojuxe.pdf
    • http://liztongmft.com/uploads/1/3/0/6/130604838/4510b977.pdf
    • http://williamwhitlow.com/uploads/1/3/0/7/130739288/fffeab8e4a.pdf
    • http://milleniummobile.ca/uploads/1/3/0/7/130738863/3029390.pdf
    • http://lucassincasa.com/uploads/1/3/0/7/130740622/tiwif.pdf
    • http://egyptcasting.com/uploads/1/3/0/7/130776331/bapanewifexafogurom.pdf
    • http://london-office-4.pleasingfood.com/uploads/1/3/0/8/130814042/130814042.html#treatment+and+nursing+management+for+aspiration+pneumonia
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004452.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4452 16036 bytes
font_01_sfnt_off00005b35.bin
60f6ae19ec65903eea2880164fcba7b4bc270bb0a3e24597e95dacf109fdb010		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5B35 7288 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.