PDF malware analysis — malicious · 5052bb32913fc467

MALICIOUS

PDF

32.4 KB Authoring application: OpenOffice Draw

MD5: 0c6ede6629db403ad9e63aeff4347526 SHA-1: 0b8ce9b95d74d58a9f3335e732efdf29d2482425 SHA-256: 5052bb32913fc4673a0d0f9936735155297e036e8d8ed585c12ab3b041be12b7

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Phishing: Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. ClamAV also detected this as Pdf.Phishing.TtraffRobotInstall-7605656-0, suggesting a phishing or traffic redirection scheme. The ML classifier strongly agrees with the malicious verdict. The document body is heavily corrupted and does not provide further context.

Machine Learning

Nyx PDF Classifier malicious score 0.9999

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://starstatusbundles.com/uploads/1/3/0/2/130270996/tekejoditeraje-xumezapom.pdf
- http://suddenweblink.online/uploads/2020/01/28/tozalimizutawute.pdf
- http://travelingnurses1.com/uploads/1/3/0/4/130483937/d8f10f5.pdf
- http://carasoul.com/uploads/1/3/0/4/130488700/kanujow_mijak_fumoxekusaw_toxolaxozuxep.pdf
- https://ranepovasa.weebly.com/uploads/1/3/0/2/130289211/gurafagezori.pdf
- http://un-mariage-a-la-reunion.fr/uploads/1/3/0/5/130589310/4676f9f254c.pdf
- https://bivoranojufubo.weebly.com/uploads/1/3/0/3/130323291/vajazawi.pdf
- http://vittonezone.com/uploads/1/3/0/5/130543065/e174a62fdc.pdf
- http://rostelekomu.fun/uploads/2020/01/28/magebofotapi_zukuvomolol.pdf
- http://goredewoge.mukhitdinov.org/uploads/2020/01/27/nuzopepu.pdf
- https://tuwenugajas.weebly.com/uploads/1/3/0/2/130271077/xekuk_nefuteto.pdf
- http://bagarem.wannahotgirlss.online/uploads/2020/01/28/5010672f5200.pdf
- https://lolijuxinu.weebly.com/uploads/1/3/0/4/130489172/c26ff4c84e74105.pdf
- http://kudunev.prosportonline.ru/uploads/2020/01/27/fexiga.pdf
- http://lupe.finresult.com/uploads/2020/01/27/vutisuresino.pdf
- https://muzetikoxufam.weebly.com/uploads/1/3/0/4/130476385/xezamodix-dalanujuvaxomaj.pdf
- https://futiroma.weebly.com/uploads/1/3/0/3/130313339/loludubufi_gesamom_jodonajoxova_jawukox.pdf
- http://jowujekija.agicole-acces.com/uploads/2020/01/28/runolokoto.pdf
- http://fearnoevilcomedy.com/uploads/1/3/0/6/130620952/xuxewijumikeg_tevugegawovil.pdf
- http://mimiscoffeehouseofhardwick.com/uploads/1/3/0/3/130379522/kipejike.pdf
- http://nokox.mupoisk.info/uploads/2020/01/29/b6ecfe643532467.pdf
- http://girokonto-vergleiche.com/uploads/2020/01/27/5516917.pdf
- http://septictankpumpinggwinett.com/uploads/1/3/0/6/130621554/nopezifuvidik-xezufobudebidu-sowezobe.pdf
- http://zetotulur.vipiski-besplatno9.icu/uploads/2020/01/27/zawar.pdf
- http://rwbickfordconstruction.com/uploads/1/3/0/2/130271080/zudavatobodup.pdf
- http://albertonorchids.com/uploads/1/3/0/3/130324248/130324248.html#bubble+sort+in+c+++program+using+templates

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000017b2.bin` `9de9c556b2ada09620af1f75a8aced86dc21cb529acb72a3de3e00513015bb3d`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x17B2	6568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.