Malicious PDF — malware analysis report

Static analysis result for SHA-256 3995625e4814204b…

MALICIOUS

PDF

75.1 KB Authoring application: OpenOffice Draw First seen: 2020-09-24
MD5: 2b09ca3c034e21023101b8f3ab845a73 SHA-1: 9dbbcea1ec7dd7a2619190a2267cda69a3bef3b1 SHA-256: 3995625e4814204b3fa732e0506eaaf1e45f8a3f7291f8bd10d81a432ad36f31
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a significant number of external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support a malicious classification. The embedded URLs suggest a phishing or traffic redirection scheme, likely aiming to lead users to malicious sites or download further malware. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9993

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.fortheloveoffairytales.com/uploads/1/3/0/3/130313698/datezijutuvu.pdf In PDF document text
    • http://laserlily.com/uploads/1/3/0/5/130588415/c4ef7ef9b6.pdfIn PDF document text
    • http://newanday.host/uploads/1/3/0/7/130739351/6741468.pdfIn PDF document text
    • http://hostmaster.rebeccagray.net/uploads/1/3/0/6/130621109/8984301.pdfIn PDF document text
    • http://www.ecoproductssa.com/uploads/1/3/0/6/130640125/1346582.pdfIn PDF document text
    • http://julzglitzgang.com/uploads/1/3/0/3/130379287/4dfc4.pdfIn PDF document text
    • http://paperexit.com/uploads/1/3/0/4/130488584/pigapugona.pdfIn PDF document text
    • http://marijuanalawvt.com/uploads/1/3/0/7/130740258/kumosede.pdfIn PDF document text
    • http://k-statebasketballplayers.net/uploads/1/3/0/6/130621776/3b1a4945163.pdfIn PDF document text
    • http://mskeleta.com/uploads/1/3/0/5/130551714/5428979.pdfIn PDF document text
    • http://nycmiddleschoolbasketballleague.com/uploads/1/3/0/6/130604465/72e1cc12f6bf24.pdfIn PDF document text
    • http://scwaterfrontworks.com/uploads/1/3/0/7/130775959/f92b35a403cf189.pdfIn PDF document text
    • http://ivanprocheret.com/uploads/1/3/0/6/130604141/muselumupa-rarugupejemox-kepujomezesu-fodumegodoninif.pdfIn PDF document text
    • http://caseinkdesign.com/uploads/1/3/0/4/130476074/nomenowedeme.pdfIn PDF document text
    • http://giftgone.com/uploads/1/3/0/2/130288458/6409187.pdfIn PDF document text
    • http://spirituallyyou.store/uploads/1/3/0/5/130589362/xonufolapovu-vesatur.pdfIn PDF document text
    • http://holeinonesotogrande.com/uploads/1/3/0/6/130621363/8440059.pdfIn PDF document text
    • http://newpathorg.com/uploads/1/3/0/6/130604560/tebujixami-suwupagezedijef.pdfIn PDF document text
    • http://designer-luxury-closet.com/uploads/1/3/0/6/130620763/e0f30a67c99cf.pdfIn PDF document text
    • http://micasitarentals.com/uploads/1/3/0/7/130775803/1a2d2ddddfc.pdfIn PDF document text
    • http://www.10forex.com/uploads/1/3/0/5/130545365/14482b.pdfIn PDF document text
    • http://ingenacel.com/uploads/1/3/0/7/130740493/3096885.pdfIn PDF document text
    • http://elizabethbrowndesign.com/uploads/1/3/0/2/130272619/1995090.pdfIn PDF document text
    • http://wagworks.co/uploads/1/3/0/7/130739381/da398ca58.pdfIn PDF document text
    • http://vgd1y.slpny.com/uploads/1/3/0/5/130590438/130590438.html#ethylene+diamine+tetra+acetic+acidIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000169c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x169C 10584 bytes
SHA-256: 73eba3b1d08a1ea8b102df6909b3c9e2ff0d645083afbab41e4ab456a485b506
font_01_sfnt_off0000c263.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC263 6496 bytes
SHA-256: 5799fb81e261f6dd50ff9b503e85c44e438542e2bf8c8893756d066a073750d7
font_02_sfnt_off0000d21a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD21A 16204 bytes
SHA-256: aa52a05aa019ab170e7355e26aba697cd146f1b97ec670bd6ff4c455a06e2c54
font_03_sfnt_off0000e701.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xE701 2732 bytes
SHA-256: ceac17bedaab402baa548dac8b20b2b61dbf52418c8a7fe477b6c25721ce9b11

Open this report in the interactive analyzer, or submit your own file for analysis.