Malicious PDF — malware analysis report

Static analysis result for SHA-256 137549c429e4899d…

MALICIOUS

PDF

45.0 KB Authoring application: LibreOffice Draw First seen: 2020-09-24
MD5: d07bea8a6e9da96f4b3bb9ded4ca7acd SHA-1: beb7db38e95816d31aa782f6447b459a65d37eaf SHA-256: 137549c429e4899d23bf799b9a2cd1700f52ccea61eb81d60842107af963eb83
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a link farm or a distribution mechanism for further malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://agencebreizstore.com/uploads/1/3/0/3/130324075/kuxeletalal_vurejadiza.pdf In PDF document text
    • http://eartrainingacademy.com/uploads/1/3/0/5/130538866/memis.pdfIn PDF document text
    • http://metzrwesleyan.com/uploads/1/3/0/6/130639530/puboxek-pusinub.pdfIn PDF document text
    • https://xujuwunekawe.weebly.com/uploads/1/3/0/2/130272421/zogosulorokim-dupematar.pdfIn PDF document text
    • http://desertliliesbazaar.com/uploads/1/3/0/5/130539315/fevowomofegibof.pdfIn PDF document text
    • http://mondokdentalmexico.com/uploads/1/3/0/4/130483739/takitetoka-penurejago-pabejufero.pdfIn PDF document text
    • http://50staaten.de/uploads/1/3/0/5/130544953/ddc4dc1367.pdfIn PDF document text
    • http://abbaproperty.com/uploads/1/3/0/2/130287514/lavazogejanojel-zewejepi-watilazasib-gojojinedizanar.pdfIn PDF document text
    • http://oakahmochafarms.com/uploads/1/3/0/5/130590374/85c2015cfa.pdfIn PDF document text
    • https://vopabibejo.weebly.com/uploads/1/3/0/4/130476266/fujanujur.pdfIn PDF document text
    • http://castlegaragepenrithltd.com/uploads/1/3/0/2/130289262/66b8a98135b80f.pdfIn PDF document text
    • http://nemamont.com/uploads/2020/01/28/afccf6.pdfIn PDF document text
    • http://whitewatercottages.com/uploads/1/3/0/6/130621856/nadakezo_depej_rovetigeben_zubed.pdfIn PDF document text
    • http://rayonlifestyle.com/uploads/1/3/0/6/130639226/422d2e0.pdfIn PDF document text
    • http://nrsvirtualservicesdev.com/uploads/1/3/0/4/130476502/mizigoj-rifajitam-lojinemoxora.pdfIn PDF document text
    • http://diz.stroimontag123.ru/uploads/2020/01/29/b47b1748d948.pdfIn PDF document text
    • http://loxejuroke.myflowshop.com/uploads/2020/01/29/mibaguduku-madukofajo-ximovamuzozaze-wuwaxifi.pdfIn PDF document text
    • http://metaradiant.org/uploads/1/3/0/4/130436315/1cc8cf3832.pdfIn PDF document text
    • http://dillybeanscateringandcafe.com/uploads/1/3/0/5/130538838/8706393.pdfIn PDF document text
    • http://euvat.solutions/uploads/1/3/0/2/130289577/5658588.pdfIn PDF document text
    • http://biwufibu.audiostart12.icu/uploads/2020/01/29/b469c0058e3f86.pdfIn PDF document text
    • http://zoxamewek.telelistamg.com/uploads/2020/01/28/kewexixas_rufoketaf.pdfIn PDF document text
    • http://chewoncakes.com/uploads/1/3/0/4/130476672/130476672.html#search+inside+yourself+chade+meng+tanIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017ad.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x17AD 8440 bytes
SHA-256: 171af46beea4a383a07b3d7badcb3f739e38bdd4e579992746ed88feb984a875
font_01_sfnt_off00006e0f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6E0F 4816 bytes
SHA-256: 6fd0bae05d41d2be687eb494b33c21a21b41dda8f32fbd20d971a1ed7e261af3

Open this report in the interactive analyzer, or submit your own file for analysis.