Malicious PDF — malware analysis report

Static analysis result for SHA-256 6c654352bb820d70…

MALICIOUS

PDF

38.8 KB Authoring application: OpenOffice.org
MD5: 3e6b9dfd45dd49dfdf2569cfb80839b4 SHA-1: 8e2e5a6f67dde75554a1fdceafeef17c00fa7631 SHA-256: 6c654352bb820d7098d3f4df17bf8ef6c4114419f10a7b20522915a24dd6ffb0
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, classifying it as phishing or a trojan downloader. The embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lawez.filll.icu/uploads/2020/01/27/tawetop-jerivarafuz-rapavu.pdf
    • http://bivegema.suddenweblink.online/uploads/2020/01/27/1068481.pdf
    • http://katienanasi.com/uploads/1/3/0/5/130550769/7c10333f7ecf2.pdf
    • https://vopajadebed.weebly.com/uploads/1/3/0/2/130272080/e5ca3bbbb8f6f5.pdf
    • http://dramaclubplays.com/uploads/1/3/0/6/130639592/fugogenevazamo-senodopimokoke.pdf
    • http://homeandproperty.org/uploads/1/3/0/2/130289570/vapaxuvadevexe-poxutomejixasi.pdf
    • http://fem.vjclinicadentalfamiliar.com/uploads/2020/01/27/gasubuwadure_lozitoxaro_liniz.pdf
    • http://liveartstampabay.org/uploads/1/3/0/6/130620973/xakenodopelapu-gepigefirud.pdf
    • https://vokimaze.weebly.com/uploads/1/3/0/5/130538931/1989925.pdf
    • http://rwpdivephotography.com/uploads/1/3/0/5/130543575/7490717.pdf
    • http://dotekob.vidracariaartvidros.site/uploads/2020/01/27/7574651.pdf
    • http://tojizid.calmlike.com/uploads/2020/01/29/rogetososuxowedufa.pdf
    • http://easyak.com/uploads/1/3/0/4/130483773/kofodajuse_pedulixajudiv_bedopulo_juzol.pdf
    • http://toma.accessory-app.com/uploads/2020/01/29/wiriki-vamutararog.pdf
    • http://nemapanuva.0706shpps04.fun/uploads/2020/01/27/miloko_fepexo_kojusiseluk.pdf
    • http://starlightbooklets.com/uploads/1/3/0/3/130379074/3711386279.pdf
    • http://misstourist.org/uploads/2020/01/28/mazubugojil.pdf
    • http://milesalumniatl.com/uploads/1/3/0/2/130289410/9006905.pdf
    • http://ntu-htfrc.weebly.com/uploads/1/3/0/2/130273993/e49bb259685.pdf
    • http://therebuildcovenant.org/uploads/1/3/0/4/130483376/medovozotuwo.pdf
    • http://chinhxacmuctieu.com/uploads/1/3/0/5/130542991/migebajejuseropunas.pdf
    • http://advance-it.net/uploads/1/3/0/5/130590756/130590756.html#chandelier+song++free

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016bb.bin
f5813c18932c4aa72fd1216e47fb9cc7440932344304afe39d5df9553cc8e25d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16BB 7976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.