Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a298fe1a878d55e…

MALICIOUS

PDF

75.8 KB Authoring application: OpenOffice.org First seen: 2020-09-24
MD5: 52e75d026c14a6db33305d30d1be590a SHA-1: 30de35fea593fc291d8256754467b273c23f2cda SHA-256: 5a298fe1a878d55e01d7f8008f157643273ed628ecb77f6f872b39ba2f1a97c8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. No scripts were extracted, and the document body content is heavily obfuscated and truncated, making it difficult to ascertain a specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9983

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://interstellarbrands.com/uploads/1/3/0/3/130323190/5b4ad21b98b6.pdf In PDF document text
    • http://checkthem.in/uploads/1/3/0/6/130604179/wirodafiberaze_tulimazeg_boris_puzezijusixoza.pdfIn PDF document text
    • http://royalelksewing.com/uploads/1/3/0/7/130740251/6653499.pdfIn PDF document text
    • http://risingskyweddings.com/uploads/1/3/0/7/130776889/dovodurezapopomarino.pdfIn PDF document text
    • http://rangakvernberg.com/uploads/1/3/0/6/130620637/tidemunepo.pdfIn PDF document text
    • http://funneladdicts.com/uploads/1/3/0/8/130873855/jujifumu.pdfIn PDF document text
    • http://believeitornotphotography.com/uploads/1/3/0/6/130604862/1c70d1357e7.pdfIn PDF document text
    • http://dorothyradio.com/uploads/1/3/0/5/130589056/wubonunesagenegemila.pdfIn PDF document text
    • http://nasty-man.com/uploads/1/3/0/7/130739197/4ec879ad.pdfIn PDF document text
    • http://alexandrethiery.com/uploads/1/3/0/4/130476703/3eaa258.pdfIn PDF document text
    • http://lab-dentalevolution.com/uploads/1/3/0/4/130476307/rifato-januse-kepimolexomapa-ramikijusizaxa.pdfIn PDF document text
    • http://www.hphotographic.co.uk/uploads/1/3/0/8/130874485/korefiwonap-vomuvusosipep.pdfIn PDF document text
    • http://mail2.widebaymotorcomplex.com/uploads/1/3/0/6/130604255/paguxalamiki.pdfIn PDF document text
    • http://babygearrentalslu.com/uploads/1/3/0/4/130476242/pixexuwafutuj-rivinugesogezu.pdfIn PDF document text
    • http://twosistersdips.com/uploads/1/3/0/5/130588773/vopotud-reresugax-tokej.pdfIn PDF document text
    • http://alexandramulholland.com/uploads/1/3/0/6/130621285/6194444.pdfIn PDF document text
    • http://www.commonwealthgardencenter.com/uploads/1/3/0/2/130287495/0372ad26171ec9.pdfIn PDF document text
    • http://www.sandiegoftc.org/uploads/1/3/0/5/130588151/kakogogajazubo.pdfIn PDF document text
    • http://alixxpartners.com/uploads/1/3/0/5/130541356/7737540.pdfIn PDF document text
    • http://www.eatjook.com/uploads/1/3/0/4/130489185/jotimavu_fupunalelokur.pdfIn PDF document text
    • http://sequoia-hc.com/uploads/1/3/0/5/130547078/4178136.pdfIn PDF document text
    • http://bcaesthetics.com/uploads/1/3/0/5/130589095/temilomixupugex.pdfIn PDF document text
    • http://host43.carmichaelnl.com/uploads/1/3/0/5/130590778/130590778.html#lord+ayyappa+songs+in+tamil+pdfIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00006e93.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6E93 16028 bytes
SHA-256: ca889182d22413b1a5b6446cd5d954c095bfc2c8b2fec1022b19199100617195
font_01_sfnt_off0000853a.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x853A 26720 bytes
SHA-256: 21ef703cf1559be1dcf4a4fc17e2b7c10699f0ef22d9b75c390cbd24d6ce1607
font_02_sfnt_off0000cc79.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xCC79 6676 bytes
SHA-256: bdbd5455d3df8f7fe30b24f92edf4c792266410b39888fe3370010fa7bb8f915

Open this report in the interactive analyzer, or submit your own file for analysis.