Malicious PDF — malware analysis report

Static analysis result for SHA-256 4dd32adf9adb9474…

MALICIOUS

PDF

43.6 KB Authoring application: OpenOffice Draw First seen: 2020-09-24
MD5: 8971dd324b545bcb4541cb234b8ad23a SHA-1: 5b81edd91d8a7438a6a7b3042f766c0c4d79d7b5 SHA-256: 4dd32adf9adb94747538f973b07102134a7afafb294b8486e2211a979401d936
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also indicate maliciousness, specifically flagging it as phishing-related. The embedded URLs likely lead to further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fireontheridge.com/uploads/1/3/0/6/130605314/vebav_pokejeretixup_vimegudodum.pdf In PDF document text
    • http://teju.miradorbascamao.com/uploads/2020/01/29/wumib.pdfIn PDF document text
    • http://rufukem.csgo-bet.ru/uploads/2020/01/27/lilux.pdfIn PDF document text
    • https://juzaxomunidovi.weebly.com/uploads/1/3/0/5/130588675/3810271.pdfIn PDF document text
    • http://sizuriz.audiostart07.icu/uploads/2020/01/27/1755168.pdfIn PDF document text
    • http://architecturalrenaissancetechniques.com/uploads/1/3/0/4/130435821/8398806.pdfIn PDF document text
    • https://xidutivog.weebly.com/uploads/1/3/0/5/130589174/zazovipesasufegovol.pdfIn PDF document text
    • http://riverbendoutdoors.com/uploads/1/3/0/5/130590689/130590689.html#the+maslach+burnout+inventory-test+mIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011d7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x11D7 8800 bytes
SHA-256: c8c0394770b5a37a7f7ecde707e5d991b2bce4ad77e3a5e7f179910fa2b0b02c

Open this report in the interactive analyzer, or submit your own file for analysis.