Malicious PDF — malware analysis report

Static analysis result for SHA-256 6e64bf19d2c3e194…

MALICIOUS

PDF

38.8 KB Authoring application: OpenOffice Draw
MD5: 6d52232e2e538c5bfb53278ef7d20d03 SHA-1: 11548a4b891411114b7d88f6c9e12a9cc3a2753e SHA-256: 6e64bf19d2c3e194a8b15ab43a3537c583399f3be84b5a9bc906f2b87b250f79
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to numerous PDF files hosted on various domains, suggesting a link farm or content distribution scheme. The ML_NYX_PDF_MALICIOUS and ClamAV detections further support the malicious nature of this file. The document body text is corrupted and does not provide further context.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://honeysandharlots.com/uploads/1/3/0/5/130540155/8338945.pdf
    • http://tomszumski.com/uploads/1/3/0/7/130776096/164370.pdf
    • http://downtownsenecasc.com/uploads/1/3/0/6/130604723/8008229.pdf
    • http://equinoxtalks.com/uploads/1/3/0/2/130289550/3181479.pdf
    • http://desatascoshospitalet.net/uploads/1/3/0/4/130478244/2006361.pdf
    • http://affiliatedtattoofamily.com/uploads/1/3/0/6/130620736/xizane_faxonuna_xipodezijefop_xuduxivuposusox.pdf
    • http://nvution.fun/uploads/1/3/0/7/130775106/6520123.pdf
    • http://clubheros.org/uploads/1/3/0/6/130604369/gezamimi.pdf
    • http://breadandfreedom.net/uploads/1/3/0/5/130545882/pebowa.pdf
    • http://annieshandmadesweets.com/uploads/1/3/0/6/130620232/a10de.pdf
    • http://monthlytights.net/uploads/1/3/0/3/130323131/6067156.pdf
    • http://julieonofrio.com/uploads/1/3/0/2/130270792/risawudereri.pdf
    • http://assistensepay.live/uploads/1/3/0/6/130604366/2662089.pdf
    • http://speakarts.com/uploads/1/3/0/8/130874011/8767698.pdf
    • http://dmnroundtable2020.com/uploads/1/3/0/6/130640013/bopewudefavotonamer.pdf
    • http://grupomuymuy.mx/uploads/1/3/0/6/130639651/kufojejifumamu.pdf
    • http://www.seltenrichwoodworks.com/uploads/1/3/0/5/130542866/846c4c2bdfb65.pdf
    • http://customlovecandles.com/uploads/1/3/0/8/130814290/422d2ccad305b.pdf
    • http://coffeejon.net/uploads/1/3/0/6/130620974/ladexodonezew.pdf
    • http://amazingdiscountonline.com/uploads/1/3/0/2/130271245/9949335.pdf
    • http://ecodentals.com/uploads/1/3/0/7/130739198/kexabaketalo.pdf
    • http://seanlenhartnarrates.com/uploads/1/3/0/2/130270941/bekagowasade-mariwowatuxes-duvivuzom-vijipivimesa.pdf
    • http://mvisionconstruction.com/uploads/1/3/0/7/130775174/718ee.pdf
    • http://mcmwebbuilder1.devsite-1.com/uploads/1/3/0/9/130969012/130969012.html#what+age+is+the+maze+runner+book+suitable+for

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000034eb.bin
32fd3eb52e0b3d024a698367b2e90f285558d5f03a9d7e66b0727ed9501f75bd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x34EB 8076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.