Malicious PDF — malware analysis report

Static analysis result for SHA-256 2d0854fe99bbce3a…

MALICIOUS

PDF

52.5 KB Authoring application: LibreOffice First seen: 2020-09-24
MD5: bc8929d7c685fe552c33f451805e5d67 SHA-1: 9fdf524170ecdf941fa78309b7a04ca0408eb877 SHA-256: 2d0854fe99bbce3a3d2e9108f16d784140fe95e990fe78d2b6db02c530481654
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also flag this as malicious. The primary attack pattern appears to be directing users to a multitude of external PDF files hosted on various domains, likely for SEO spam or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://amazonchristmastree.com/uploads/1/3/0/7/130776541/tumeka.pdf In PDF document text
    • http://soundengineercanada.com/uploads/1/3/0/4/130488295/0cca55e.pdfIn PDF document text
    • http://hostmaster.thegranarypenzance.co.uk/uploads/1/3/0/6/130639848/2780645.pdfIn PDF document text
    • http://mta-sts.mail.rikking.com/uploads/1/3/0/2/130272909/6299952.pdfIn PDF document text
    • http://jackyoung.co.za/uploads/1/3/0/6/130621215/3718879.pdfIn PDF document text
    • http://charlesdickensjewelry.com/uploads/1/3/0/5/130590295/mazonibuwinulibep.pdfIn PDF document text
    • http://www.esmacats.com/uploads/1/3/0/6/130621814/ae0d5e8ee4e32fc.pdfIn PDF document text
    • http://mta-sts.mail.criteriummarketing.com/uploads/1/3/0/4/130483667/2747102.pdfIn PDF document text
    • http://gaskinsgadgets.com/uploads/1/3/0/6/130639655/6965482.pdfIn PDF document text
    • http://teamthumann.com/uploads/1/3/0/8/130813658/6166304.pdfIn PDF document text
    • http://abrushwithnature.studio/uploads/1/3/0/6/130605161/9701833.pdfIn PDF document text
    • http://www.heavensgatescherryfarm.net/uploads/1/3/0/6/130604599/1443057.pdfIn PDF document text
    • http://www.topographyandink.com/uploads/1/3/0/9/130969552/fobufudif.pdfIn PDF document text
    • http://familygrowthcenter.com/uploads/1/3/1/0/131071220/cb1d770e6004.pdfIn PDF document text
    • http://ozimek.net/uploads/1/3/0/6/130622089/vetaxu-tuvigunawimibox-vizobizududov-biwufixonu.pdfIn PDF document text
    • http://adsl-63-204-18-36.benefitplans.org/uploads/1/3/0/5/130539440/9741795.pdfIn PDF document text
    • http://thepadremotel.com/uploads/1/3/0/6/130621422/8426774.pdfIn PDF document text
    • http://christopherreyesstudio.com/uploads/1/3/0/5/130589050/dbdb027073c.pdfIn PDF document text
    • http://teacherspetscalvert.com/uploads/1/3/0/5/130589308/2938838.pdfIn PDF document text
    • http://louisaanderic.com/uploads/1/3/0/2/130289171/kesojifo-mosenuker-janefen-zazawuvu.pdfIn PDF document text
    • http://bamboohealthsocks.com/uploads/1/3/0/8/130814666/rikomeref.pdfIn PDF document text
    • http://adventoursabroad.com/uploads/1/3/0/5/130544446/nidam.pdfIn PDF document text
    • http://www.greencircleweb.com/uploads/1/3/0/5/130550937/130550937.html#big+data+analysis+notes+pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033ec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x33EC 16224 bytes
SHA-256: da097a8c459adbfdf1b1d97412e41569b305acf822c6e113ff3e46e38a168572
font_01_sfnt_off000048c3.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x48C3 2228 bytes
SHA-256: 236d54f3e2479d5e72da3d1be4616617e509581c3e9108e812f40a19f40d28ff
font_02_sfnt_off000052ef.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x52EF 8104 bytes
SHA-256: 05558a388539c6acfb78530beea160568e0df548ebcb0cc6ed0db7441a58522a
font_03_sfnt_off00006a9d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6A9D 8360 bytes
SHA-256: 5d53c2945c9faea56aff6b47e8794ee44415989b465db6e8e0034b5d1d60b4f7

Open this report in the interactive analyzer, or submit your own file for analysis.