Malicious PDF — malware analysis report

Static analysis result for SHA-256 4166ef70d06834fb…

MALICIOUS

PDF

40.8 KB Authoring application: OpenOffice.org
MD5: b8923b2d9058874110e6805b345cb251 SHA-1: b8038d889cf931552763305e53ddf275c51215e5 SHA-256: 4166ef70d06834fb9fc5211f7a77dadc1adb1023bce5cdb5ab7f050d679af1b5
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links to other PDF files, a technique commonly used for SEO poisoning and distributing malware. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs are likely part of a campaign to redirect users to malicious content, disguised as legitimate documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sosdetail.com/uploads/1/3/0/2/130270985/bipezadug.pdf
    • http://kingwoodtreeservices.com/uploads/1/3/0/5/130546432/vejuganot.pdf
    • http://meridenoilcompany.com/uploads/1/3/0/4/130483242/1833732.pdf
    • http://xegon.stoloto.info/uploads/2020/01/28/lazuno_fatuxixopuvotip_rowesafeli.pdf
    • http://chugachpt.com/uploads/1/3/0/7/130739763/kajagejug.pdf
    • http://michaelshusko.com/uploads/1/3/0/2/130289426/130289426.html#basketball+fitness+programs

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010a9.bin
316398f3e0a6d4e52f085a9dad42cf910b2785e80fc3112761926ac1c0193380		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10A9 8152 bytes
font_01_sfnt_off000058ef.bin
741ece390710c9ce551b2434aa67aafe1f22e1a7d3b5046e96e9d892d94e814a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x58EF 16176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.