Malicious PDF — malware analysis report

Static analysis result for SHA-256 38743c9627a250db…

MALICIOUS

PDF

54.0 KB Authoring application: OpenOffice Draw First seen: 2020-09-04
MD5: 9dbd28300380312a0f91df7eb910edf1 SHA-1: a05bd348abe6f3e547935c1fb67dd34c63fcb4ea SHA-256: 38743c9627a250dbfa82edb639ef87fc6113036d55ef6e97a9ca7fde9a4f0d7f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. This strongly suggests a phishing or malware distribution attempt. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this, indicating a known phishing or traffic redirection pattern. No scripts were extracted from this sample, but the extensive link farm points to a malicious intent to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://1.bpmtc.com/uploads/1/3/0/6/130639161/gobetegazuponum-wejarono-niwinidesulos-wodinaradoxana.pdf In PDF document text
    • http://sawtoothmountaincider.com/uploads/1/3/0/6/130639438/vafufadajixipe.pdfIn PDF document text
    • http://triadstartup.com/uploads/1/3/0/7/130776644/3640045.pdfIn PDF document text
    • http://corefirecommando.com/uploads/1/3/0/7/130738741/jimena.pdfIn PDF document text
    • http://luhome.me/uploads/1/3/0/4/130476628/3157e7a0.pdfIn PDF document text
    • http://tarifgo.de/uploads/1/3/0/5/130538817/taxuxim_disofemivitere_pewizi_puzakunagej.pdfIn PDF document text
    • http://amazinglandscaping.net/uploads/1/3/0/5/130590535/tofilozagefixom.pdfIn PDF document text
    • http://flowerhouseict.com/uploads/1/3/0/8/130814531/36e12ba.pdfIn PDF document text
    • http://plantsforpermaculture.com/uploads/1/3/0/4/130477064/liraxepuwudav-dexubirepikopix-dilob-nibos.pdfIn PDF document text
    • http://michifuzz.com/uploads/1/3/0/2/130272955/2880632.pdfIn PDF document text
    • http://anappleatdawn.com/uploads/1/3/0/4/130483178/148eb.pdfIn PDF document text
    • http://dedicated-22.pleasingfood.com/uploads/1/3/0/6/130621044/130621044.html#advanced+glycation+end+products+periodontitisIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006d14.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6D14 2924 bytes
SHA-256: 91b6e3a124790fa38f2e5be79d693be4d2b3db08518e7cecf82c4a43852f2e52
font_01_sfnt_off00007a65.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7A65 9104 bytes
SHA-256: b60ccafe9e0142448e2e57c0bce90b840e0661f37e7a680d6f4914809992e7a5

Open this report in the interactive analyzer, or submit your own file for analysis.