Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a2c132d7853992e…

MALICIOUS

PDF

68.3 KB Authoring application: OpenOffice Draw First seen: 2020-09-24
MD5: 412f6dd7eabb55ad1b0f3167aba260bd SHA-1: f61de429d67c88b599ff36885c4df5926a2576b8 SHA-256: 5a2c132d7853992e2b4e2ceb5fd0fbf28755d88653b26f7a7dd52ea038a738eb
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on various domains, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or distribute further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output further support its malicious nature. No scripts were extracted, but the primary attack pattern involves directing users to external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stripperbud.com/uploads/1/3/0/6/130621412/lovuxagalanezod.pdf In PDF document text
    • https://fibutigojojox.weebly.com/uploads/1/3/0/2/130289611/6724900.pdfIn PDF document text
    • http://philmontcapital.com/uploads/1/3/0/6/130622077/2616019.pdfIn PDF document text
    • http://guratavis.party.su/uploads/2020/01/27/kimojupov_panetil_gapuz_mepomu.pdfIn PDF document text
    • https://nalizoxuvot.weebly.com/uploads/1/3/0/4/130489228/8109235.pdfIn PDF document text
    • http://noli.tzvetnielinzi.ru/uploads/2020/01/28/begadilulirugif.pdfIn PDF document text
    • http://thetracker.online/uploads/2020/01/28/mavefeji_jabivajed_gozoxumu.pdfIn PDF document text
    • http://nafox.audiostart03.icu/uploads/2020/01/28/gagazozukiv.pdfIn PDF document text
    • http://dosax.poste-tunisienne.com/uploads/2020/01/29/4510936.pdfIn PDF document text
    • http://varsitygreekstore.com/uploads/1/3/0/6/130620343/ecc099fc9d9c.pdfIn PDF document text
    • http://sekokutir.levina.info/uploads/2020/01/28/degaxumukefuxus.pdfIn PDF document text
    • https://vopajadebed.weebly.com/uploads/1/3/0/2/130272080/xabezefotefore_nanenurunuxewor_jurakas.pdfIn PDF document text
    • http://mek.photorobots.ru/uploads/2020/01/28/6710564.pdfIn PDF document text
    • http://zudir.windowscaner.ru/uploads/2020/01/27/fukirunavowe_nilitolum_jisogijubezena_gidonofuju.pdfIn PDF document text
    • http://brooklyncollegemfashowcase.com/uploads/1/3/0/5/130551086/8126462.pdfIn PDF document text
    • http://allthingsroe.com/uploads/1/3/0/2/130289774/311bf0.pdfIn PDF document text
    • http://dariguve.monplezir.su/uploads/2020/01/27/suwuxuzi.pdfIn PDF document text
    • http://jewu.ethereumcryptos.biz/uploads/2020/01/27/misipu.pdfIn PDF document text
    • https://xalotizem.weebly.com/uploads/1/3/0/5/130542971/9499416.pdfIn PDF document text
    • https://wabomikevoluriz.weebly.com/uploads/1/3/0/3/130379126/kimedi.pdfIn PDF document text
    • http://nef.mariaflights.com/uploads/2020/01/28/193262ce.pdfIn PDF document text
    • http://jdmcreative.com/uploads/1/3/0/5/130588497/fixumenuko-jufejeb.pdfIn PDF document text
    • http://100kakrd.ru/uploads/2020/01/27/6cafb4d.pdfIn PDF document text
    • http://aroma-piter.ru/uploads/2020/01/27/93541f8b564e38d.pdfIn PDF document text
    • http://santacruzishome.com/uploads/1/3/0/4/130476313/gumusumosat.pdfIn PDF document text
    • http://annotalegal.com/uploads/1/3/0/5/130588336/130588336.html#cisco+2960+x+poe+switch+datasheetIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
🗂 Part of campaign: kevinpendergast.com 7 samples

Related samples 7

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000018d1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x18D1 10252 bytes
SHA-256: 5dafc4f8c3dfd6217c723c8ac5463abc7e39b3cc197a4e8d212fae6520a53d16
font_01_sfnt_off0000d0c6.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xD0C6 2696 bytes
SHA-256: cb1c8cbf188b645d16f95c9c252f2ebc66d3fda19335e70e885de5089d495fe5

Open this report in the interactive analyzer, or submit your own file for analysis.