Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b95fb27199e9afd…

MALICIOUS

PDF

36.5 KB Authoring application: OpenOffice.org First seen: 2020-09-24
MD5: f207a0c0aef0f29bd5c14739011b9fe1 SHA-1: bc6c4ddc810043e9b5cad48a06723599e46349c8 SHA-256: 7b95fb27199e9afd3879936bdecd3f87e8bc1ab5fb7da0ecf003890a6fb9b3cc
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to other PDF files hosted on various domains, suggesting a tactic to manipulate search engine results or distribute additional malicious content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious classification.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://aspyr.co.uk/uploads/1/3/0/5/130547116/pelonokaxededoperi.pdf In PDF document text
    • http://grahamcooley.com/uploads/1/3/0/2/130273894/welaxig.pdfIn PDF document text
    • http://kelseyhopebrewer.com/uploads/1/3/0/4/130488063/wesomiludej_lixupe.pdfIn PDF document text
    • http://www.my-thm-story.blog/uploads/1/3/0/9/130969618/zujilexodegilimave.pdfIn PDF document text
    • http://www.ppsid.com/uploads/1/3/0/4/130483703/zegewumesawadurebav.pdfIn PDF document text
    • http://minigypsyhorse.com/uploads/1/3/0/6/130639192/1715044.pdfIn PDF document text
    • http://nurtureministries.com/uploads/1/3/0/5/130545484/5201980.pdfIn PDF document text
    • http://tripsupplies.shop/uploads/1/3/0/6/130622061/2572373.pdfIn PDF document text
    • http://travelenjoy.net/uploads/1/3/0/5/130541285/galatejebegifat-wiwakuvovo-nebewaxilebef.pdfIn PDF document text
    • http://teacupsanddresses.com/uploads/1/3/0/7/130775806/a44e16.pdfIn PDF document text
    • http://jzia.com/uploads/1/3/0/2/130287915/363412.pdfIn PDF document text
    • http://columbiacountysnowfest.com/uploads/1/3/0/4/130476616/topeba-wumawiw-gezopadobolegan.pdfIn PDF document text
    • http://brandpants.com/uploads/1/3/0/5/130590122/dubixakovedigu.pdfIn PDF document text
    • http://thecottonlickers.com/uploads/1/3/0/3/130312925/4730111.pdfIn PDF document text
    • http://a1893059xstreamtravel.xsideas.com/uploads/1/3/0/6/130605403/130605403.html#nescafe+dolce+gusto+jovia+capsulesIn PDF document text

Related samples 1

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003319.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3319 8660 bytes
SHA-256: 9d45d601dacd0eddc713a6615ef5202adece8f81f6a787aefb40fbe3a26ca1aa

Open this report in the interactive analyzer, or submit your own file for analysis.