Malicious PDF — malware analysis report

Static analysis result for SHA-256 2c3ae3a86fa6f1a2…

MALICIOUS

PDF

89.1 KB Authoring application: OpenOffice Draw
MD5: 24e02d427a8029209f48ada36319f380 SHA-1: 81780100e7eb0664d76c26481ec1eb65ab148ef7 SHA-256: 2c3ae3a86fa6f1a260c22206c478ad511fb8810bb43766b17ec21a898b0a4cf7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by ClamAV and an ML classifier. It contains a large number of external links, indicating it functions as a link farm. The primary heuristic firing, PDF_SEO_LINK_FARM, confirms this behavior, with the dominant host being mmccolorado.online. The embedded URLs likely lead to phishing pages or further malware downloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9893

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mmccolorado.online/uploads/1/3/0/6/130605331/jumufofatuf_jijupotapud.pdf
    • http://britemoonmarketing.com/uploads/1/3/0/4/130490399/3585529.pdf
    • http://solidrocklouisville.com/uploads/1/3/0/6/130604639/vixiniseziwevurog.pdf
    • http://manufactura.pro/uploads/2020/01/29/nodedevip_kijupaxo_zujiveg_toxabav.pdf
    • http://asburycropfarm.org/uploads/1/3/0/6/130605325/154aa90edb.pdf
    • http://vibusa.indmovieonline.club/uploads/2020/01/28/6365166.pdf
    • http://nom-vula.com/uploads/1/3/0/6/130620869/rojox-mosodiwep-waxidunevewa-kodanigitux.pdf
    • http://alohahairnmakeupbygg.com/uploads/1/3/0/4/130436236/jebabekizavas.pdf
    • http://chainbreakingrecoverycoaching.com/uploads/1/3/0/3/130313748/130313748.html#motor+toshiba+tikk

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013dd.bin
941535fa6896f90d1f0985d4c10bec5d650ed61bfa6b4947b581ca0f110e73ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13DD 8028 bytes
font_01_sfnt_off00005f16.bin
eed0848e0b72052d4c7e50313512c26fb5984a84699943bfc10b9a9a4a18cb83		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5F16 13796 bytes
font_02_sfnt_off00007cf3.bin
78be1777058559ca6e9f534df910815150f427ed73e7d3f8356b5d6ad295bc3a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7CF3 16544 bytes
font_03_sfnt_off000093ea.bin
bc25a51c6eee768501e78d1fb555c26faf48f17c03171d147f326057a99f0645		 pdf-font-stream PDF embedded font (sfnt) at offset 0x93EA 15852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.