Malicious PDF — malware analysis report

Static analysis result for SHA-256 344d64299ddf4727…

MALICIOUS

PDF

45.8 KB Authoring application: OpenOffice Draw First seen: 2021-01-15
MD5: e26d83db1be914f923b4a6dbe0b6d109 SHA-1: 3e4829d72807f5e674ed87904b9f4e36b4707fd8 SHA-256: 344d64299ddf47278f707155dac566be28a98004f3a4f7c9aa72893834cba08a
152 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://callihanenglish.com/uploads/1/3/0/6/130604550/nurogirujani.pdf In PDF document text
    • http://commercialstoragebirminghamal.com/uploads/1/3/0/6/130640102/sapadovisisisofika.pdfIn PDF document text
    • http://lianefong.com/uploads/1/3/0/2/130289354/liramivabojoxe.pdfIn PDF document text
    • http://sentientmind.org/uploads/1/3/0/2/130271004/gigarowawig-togitufire-gevogepanusow.pdfIn PDF document text
    • http://dadevilleband.com/uploads/1/3/0/6/130620635/a54555811.pdfIn PDF document text
    • http://nativeamericanfluteshop.com/uploads/1/3/0/4/130488983/3920133.pdfIn PDF document text
    • http://mhsdoernbecher.com/uploads/1/3/0/2/130291491/virepamufijulo-xarirazegexa.pdfIn PDF document text
    • http://shop.bigstuf.com/uploads/1/3/0/6/130620931/reletejud.pdfIn PDF document text
    • http://punani.world/uploads/1/3/0/6/130621870/rufimetar.pdfIn PDF document text
    • http://jed.serovatextile.ru/uploads/2020/01/29/dusixunexizusebolo.pdfIn PDF document text
    • http://torreazul.es/uploads/1/3/0/2/130288864/foxorodufolodavat.pdfIn PDF document text
    • http://cowle.de/uploads/1/3/0/2/130291646/bc25d39229a5.pdfIn PDF document text
    • http://pthqibnusina.com/uploads/1/3/0/3/130313224/tikizejamuwope.pdfIn PDF document text
    • http://duvowukoki.neupustishans.ru/uploads/2020/01/28/5ad4897877.pdfIn PDF document text
    • http://ccaabasketball.org/uploads/1/3/0/4/130435960/3920937.pdfIn PDF document text
    • http://dinotikes.com/uploads/1/3/0/5/130550973/2ca1b.pdfIn PDF document text
    • http://numaluvuf.familiarizarse.info/uploads/2020/01/28/mabubod-movidavuxe.pdfIn PDF document text
    • http://spanish-expressions.com/uploads/1/3/0/4/130488295/vidabobuwo_nujinepa.pdfIn PDF document text
    • http://matras.express/uploads/1/3/0/6/130604522/4955452.pdfIn PDF document text
    • http://younglitigator.org/uploads/1/3/0/6/130639273/pipawelitekobidetu.pdfIn PDF document text
    • http://mmarconsultoriodeenfermeria.com/uploads/1/3/0/6/130621046/9bb3fe2a727b.pdfIn PDF document text
    • http://northamericapolechampionship.com/uploads/1/3/0/3/130379597/6076211608556.pdfIn PDF document text
    • http://mindyourbodyfitnessandnutrition.com/uploads/1/3/0/6/130603903/6114091.pdfIn PDF document text
    • http://roguecosmetique.shop/uploads/1/3/0/4/130494871/3851714.pdfIn PDF document text
    • http://nokia-review.com/uploads/1/3/0/6/130621744/2449406.pdfIn PDF document text
    • http://chandalinchamplin.net/uploads/1/3/0/5/130545800/130545800.html#trial+of+wisdom+bfaIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000177e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x177E 7960 bytes
SHA-256: 2803f973373be4882f5bac4bcaa0ea48373d88e5f23bdc5e30e3b9f19591eaeb
font_01_sfnt_off00006bfd.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6BFD 16036 bytes
SHA-256: f335bbb8769c533cbca16f6384a9be7e2e65528b9693bf598f9b6a21ed261b2e

Open this report in the interactive analyzer, or submit your own file for analysis.