Malicious PDF — malware analysis report

Static analysis result for SHA-256 776699686a1ff989…

MALICIOUS

PDF

50.1 KB Authoring application: OpenOffice.org First seen: 2020-09-24
MD5: 619caaf7ce8c4b6794e858dd143ad706 SHA-1: 4ec2b9d0ed6848caca014f56c06eda05b7ac1f22 SHA-256: 776699686a1ff989032af5afa63e2434b96f6339e1249d552f4801bcaa04d9ae
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. ClamAV also detected this file as Pdf.Phishing.TtraffRobotInstall-7605656-0. The primary function appears to be directing users to a vast collection of other PDF files hosted on numerous domains, likely for malicious purposes such as SEO poisoning or distributing further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://damaebanisteria.com/uploads/1/3/0/6/130605263/3467709.pdf In PDF document text
    • http://www.colorfulmodern.com/uploads/1/3/0/7/130738591/zawipa.pdfIn PDF document text
    • http://botoxduluth.com/uploads/1/3/0/7/130775297/9500864.pdfIn PDF document text
    • http://cpanel.cascadebga.org/uploads/1/3/0/6/130639357/razokapumalogakal.pdfIn PDF document text
    • http://www.luther2017.org/uploads/1/3/0/4/130488834/remolop.pdfIn PDF document text
    • http://danaroberts.com/uploads/1/3/0/5/130588740/mumijejaf-baragevugegag-bofibagenezuvo.pdfIn PDF document text
    • http://janeflegal.com/uploads/1/3/0/5/130539652/nibud.pdfIn PDF document text
    • http://abundantlifecog.net/uploads/1/3/0/7/130775361/nozidi_xudivorufovugof.pdfIn PDF document text
    • http://silverarcherdesigns.com/uploads/1/3/0/3/130323601/nefagokun.pdfIn PDF document text
    • http://cemento-stampato.org/uploads/1/3/0/6/130621698/xorogugarig-kerazok.pdfIn PDF document text
    • http://albara4u.com/uploads/1/3/0/5/130550983/xupuzimipoges.pdfIn PDF document text
    • http://dns1.rubenslamel.com/uploads/1/3/0/8/130813991/duveto_rewazobofu_mobofitumur_marepubanuga.pdfIn PDF document text
    • http://ddiamondco.com/uploads/1/3/0/7/130739379/jugunewazedu.pdfIn PDF document text
    • http://hostmaster.zingezong.com/uploads/1/3/0/8/130874655/zopakozexo.pdfIn PDF document text
    • http://bohojane.com/uploads/1/3/0/7/130775164/71ce35a.pdfIn PDF document text
    • http://stop-n-smelltheflowers.com/uploads/1/3/0/6/130620763/makolujudedejabijuna.pdfIn PDF document text
    • http://myescondidosoccer.com/uploads/1/3/0/4/130475955/dipopiga.pdfIn PDF document text
    • http://webdisk.xebex.eu/uploads/1/3/0/6/130605019/8070092.pdfIn PDF document text
    • http://islandscast.com/uploads/1/3/0/8/130874143/5308948.pdfIn PDF document text
    • http://www.panduct.com/uploads/1/3/0/2/130271113/fibibiwoxifinix.pdfIn PDF document text
    • http://extentrics.com/uploads/1/3/0/4/130483288/4580390.pdfIn PDF document text
    • http://harrisonashtonphoto.com/uploads/1/3/0/5/130540085/f41e4fb19224c.pdfIn PDF document text
    • http://taiyangchengyulewang888ya.br3h.com/uploads/1/3/0/6/130603842/130603842.html#online+unicode+hindi+typing+test+remington+keyboardIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003255.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3255 8664 bytes
SHA-256: d24dbdf357729008218e53e6619941fe87146988c8cb5017a7c1158471ec3b8b
font_01_sfnt_off00004c8d.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4C8D 8556 bytes
SHA-256: dcb05807abfffaebab1386e3798b0cab0a98394977d664f1624ac0fdaa3ad1f8
font_02_sfnt_off00006944.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6944 16036 bytes
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63