Malicious PDF — malware analysis report

Static analysis result for SHA-256 7ce511e514b84ca1…

MALICIOUS

PDF

43.5 KB Authoring application: LibreOffice First seen: 2020-09-24
MD5: b2f3b7cc6048d33c9b32e584ff97e8d1 SHA-1: 1a4b9d71271aef6fe2b23800adfacac6bb614788 SHA-256: 7ce511e514b84ca1b9901d5811437204a5dc000550f7a693cf367db875b51eed
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF contains a large number of embedded external links to other PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to manipulate search engine results or to distribute a large volume of content, potentially malicious. The ML classifier and ClamAV detection strongly support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hostmaster.speederscabs.com/uploads/1/3/0/4/130476649/kuxujewovajel.pdf In PDF document text
    • http://mail.myosotisdesigns.com/uploads/1/3/0/3/130313634/jutuxuludi_gapupuvegon_madarune.pdfIn PDF document text
    • http://bartenderbitch.com/uploads/1/3/0/2/130270873/mironow_wigujapujowe_selutezuzodun.pdfIn PDF document text
    • http://mustardseedboutiquemass.com/uploads/1/3/0/2/130270945/pewomefepurup_tewulenejugos.pdfIn PDF document text
    • http://koches.design/uploads/1/3/0/4/130435602/4659049.pdfIn PDF document text
    • http://couchbnb.com/uploads/1/3/0/6/130621905/galolixijaxomi.pdfIn PDF document text
    • http://truscapelandscape.com/uploads/1/3/0/9/130969837/xuruvegewu.pdfIn PDF document text
    • http://drybarfranchise.com/uploads/1/3/0/8/130874338/rozelimefal.pdfIn PDF document text
    • http://inqeparo.com/uploads/1/3/0/5/130588461/7e5da.pdfIn PDF document text
    • http://balmingileadskincare.com/uploads/1/3/0/3/130379297/1042653.pdfIn PDF document text
    • http://thelearnnplayhouse.com/uploads/1/3/0/7/130740616/pakesotapitekese.pdfIn PDF document text
    • http://mogulmeadows.org/uploads/1/3/0/5/130589163/1414140.pdfIn PDF document text
    • http://mail.richardhermanart.com/uploads/1/3/0/7/130775598/0984915796cd902.pdfIn PDF document text
    • http://circumchange.ca/uploads/1/3/0/4/130436159/0ae23.pdfIn PDF document text
    • http://ipedagogics.com/uploads/1/3/0/2/130289611/6073554.pdfIn PDF document text
    • http://goget.social/uploads/1/3/0/5/130547728/bozido.pdfIn PDF document text
    • http://motionalstudios.com/uploads/1/3/0/7/130776162/fizasejenedo_misafil_wukix_lelerurim.pdfIn PDF document text
    • http://vedantchandra.com/uploads/1/3/0/5/130589145/a75e8e7f4fe1.pdfIn PDF document text
    • http://cuttingedgepoodles.com/uploads/1/3/0/4/130483477/jutijikezixage-moragasi-jiwojow-doxoxudopin.pdfIn PDF document text
    • http://lakewoodlimo.net/uploads/1/3/0/5/130539885/jadugodovosim.pdfIn PDF document text
    • http://caribbeanshadeproducts.com/uploads/1/3/0/3/130312974/5201384.pdfIn PDF document text
    • http://thewilkinsonswordshop.com/uploads/1/3/0/7/130740012/pokurijepax.pdfIn PDF document text
    • http://projectdreamport.net/uploads/1/3/0/5/130541031/kimovala.pdfIn PDF document text
    • http://islandbaycycleway.org/uploads/1/3/0/5/130545360/233449.pdfIn PDF document text
    • http://host13.pleasingfood.com/uploads/1/3/0/3/130323774/130323774.html#genero+lirico+epico+narrativo+e+dramaticoIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000046d4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x46D4 8584 bytes
SHA-256: 8d8012e68b17acf398abdeb3377b8c2b344c352180e4d43da1f062e0199beb81

Open this report in the interactive analyzer, or submit your own file for analysis.