Malicious PDF — malware analysis report

Static analysis result for SHA-256 628f061f0d0ee9f2…

MALICIOUS

PDF

37.5 KB Authoring application: LibreOffice First seen: 2020-09-24
MD5: c1fc3e034fe679e07b765ea70eb059cd SHA-1: d19cc1675db78a095b7f3326ff0bfcf3d7b35c3b SHA-256: 628f061f0d0ee9f22c940ab4c579feb066f7fa1fe67a89a8f7e9e0a10fa6ddec
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ivflush.com/uploads/1/3/0/7/130738759/1b78f3e08a7b1.pdf In PDF document text
    • http://www.kayhewitt.com/uploads/1/3/0/6/130621868/mivotibijulimidi.pdfIn PDF document text
    • http://ellaayalon.org/uploads/1/3/0/8/130814611/lujefuzariwus.pdfIn PDF document text
    • http://www.companionanimalmemorials.com/uploads/1/3/0/7/130738740/8319123.pdfIn PDF document text
    • http://monsterotiqa.com/uploads/1/3/0/5/130590229/8189462.pdfIn PDF document text
    • http://rarebreedmuzak.com/uploads/1/3/0/6/130621794/eddfc45b.pdfIn PDF document text
    • http://cphmail.com/uploads/1/3/0/5/130551943/jotojigavafatijupov.pdfIn PDF document text
    • http://tsencheng.com/uploads/1/3/0/4/130435531/f69117717a1.pdfIn PDF document text
    • http://panamericannano2017.com/uploads/1/3/0/5/130544591/6173eb3fb1b5bd0.pdfIn PDF document text
    • http://noebrown.com/uploads/1/3/0/6/130640018/b8fa4c58.pdfIn PDF document text
    • http://www.editonhudson.com/uploads/1/3/0/8/130814106/9843934.pdfIn PDF document text
    • http://mountainmotoadventures.com/uploads/1/3/0/5/130543173/4649757.pdfIn PDF document text
    • http://room2dream.net/uploads/1/3/0/6/130604083/bekovuzovozit-rewogopebeguzok-wemara-jimege.pdfIn PDF document text
    • http://cinecharal.com/uploads/1/3/0/5/130543377/2043726.pdfIn PDF document text
    • http://abdelbassitsenhadji.com/uploads/1/3/0/5/130550951/49f22a88b29d1e.pdfIn PDF document text
    • http://tryhardkitchen.com/uploads/1/3/0/4/130488914/2911360.pdfIn PDF document text
    • http://www.pbellock.com/uploads/1/3/0/6/130603690/71c8ba81dd.pdfIn PDF document text
    • http://wemakesales.com/uploads/1/3/0/7/130739782/paneju.pdfIn PDF document text
    • http://juanpallywood.com/uploads/1/3/0/5/130588282/98a2d4f2.pdfIn PDF document text
    • http://purpleboots.net/uploads/1/3/0/6/130604049/xuduboruwu.pdfIn PDF document text
    • http://rivron2.net/uploads/1/3/0/2/130272364/nusagogeriripaz_nepopidu.pdfIn PDF document text
    • http://www.cokidstherapy.com/uploads/1/3/0/3/130313524/2d82a9af0361.pdfIn PDF document text
    • http://creativelevity.com/uploads/1/3/0/6/130639762/e658861.pdfIn PDF document text
    • http://aiboyule.br3h.com/uploads/1/3/0/5/130588320/130588320.html#patofisiologi+hernia+umbilikalis+pdfIn PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000031c9.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x31C9 7476 bytes
SHA-256: b9742e3362a1118a0344a8b8fdd6104db332325f12f522cfd09f8a578ef577b8

Open this report in the interactive analyzer, or submit your own file for analysis.