Malicious PDF — malware analysis report

Static analysis result for SHA-256 157b9a39e258bd86…

MALICIOUS

PDF

90.6 KB Authoring application: LibreOffice
MD5: 28a5ca2a2447c58d7ddaf185f4313d50 SHA-1: 6682530c6664c4eb45248c198f8162ae0b0962fa SHA-256: 157b9a39e258bd8658e8469009f557ea4c6c3f5737d6a1d769231284ba4a5506
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO spam or to distribute malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs are the primary IOCs, suggesting a link farm or distribution network.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://toscanoconstruction.com/uploads/1/3/0/6/130639327/jozuzo.pdf
    • http://independentit.net/uploads/1/3/0/6/130620532/siraniro-kekuxatexasiv.pdf
    • http://4x4discovery.com/uploads/1/3/0/2/130272406/kowawud.pdf
    • http://turizmtlt.ru/uploads/2020/01/28/wevobe_xojepijageze_wovejax.pdf
    • http://riverhaircompany.com/uploads/1/3/0/5/130550754/9107443.pdf
    • http://europeanwaxing.us/uploads/1/3/0/6/130605448/b369303.pdf
    • http://merakicuts.com/uploads/1/3/0/3/130313513/tixedi-numozikuleju-vilefoz.pdf
    • https://vimotubaguf.weebly.com/uploads/1/3/0/2/130270859/581248.pdf
    • https://zuvebafowo.weebly.com/uploads/1/3/0/2/130288762/jaboz_tunogowis_woginetag_donerakofipoda.pdf
    • https://xavijudiliveme.weebly.com/uploads/1/3/0/4/130476816/velonusigufago_gidib.pdf
    • http://safe.7gnomov.biz/uploads/2020/01/28/xexasa.pdf
    • http://wakefieldwalkingwomensnetwork.weebly.com/uploads/1/3/0/5/130544448/tolasugutumadolugeni.pdf
    • http://juwuradir.rosspsi.ru/uploads/2020/01/27/1971238.pdf
    • http://dadempire.com/uploads/1/3/0/4/130490665/fobagasezobelov.pdf
    • http://cetai.org/uploads/1/3/0/4/130489706/levibewaza_gesujerukatop_jajome_xoravelalil.pdf
    • http://worthingarchaeological.weebly.com/uploads/1/3/0/6/130621098/nelegi.pdf
    • http://kreativekidsworld.com/uploads/1/3/0/5/130551055/130551055.html#2013+chevy+spark+car+manual

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000149f.bin
d624ac51bb67159c3983b8943e2fb613f6ad9bd25b8732eb89b5386971a36791		 pdf-font-stream PDF embedded font (sfnt) at offset 0x149F 6840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.