Malicious PDF — malware analysis report

Static analysis result for SHA-256 7e6634168d359ce0…

MALICIOUS

PDF

47.7 KB Authoring application: OpenOffice.org First seen: 2020-09-24
MD5: 62b6f45563bf86eefffd78d7f5f9728d SHA-1: 119d4720e6e6f2e128d0a78d73e66083901c0924 SHA-256: 7e6634168d359ce02bace3150e5a51409ba31a9a553f72836df9ce774afd1baf
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, forming a link farm, which is a common technique for distributing malicious content. The heuristic 'PDF_SEO_LINK_FARM' and ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly indicate malicious intent. The document body's mention of 'Dispute credit report with equifax' suggests a phishing or scam lure to encourage users to click on the malicious links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nooracademyonline.com/uploads/1/3/0/3/130313504/kadetexex.pdf In PDF document text
    • http://christineszinner.com/uploads/1/3/0/6/130621782/2ef3f2ce32d29e1.pdfIn PDF document text
    • http://mybestloanrate.com/uploads/1/3/0/2/130272603/5914516.pdfIn PDF document text
    • http://derwoodmarket.org/uploads/1/3/0/6/130639327/doxofonikeve-xaloguzexivod.pdfIn PDF document text
    • http://northpointed.com/uploads/1/3/0/3/130324419/sapugagumi-zibij.pdfIn PDF document text
    • http://polyhomes.weebly.com/uploads/1/3/0/5/130589409/979346.pdfIn PDF document text
    • http://hblogix.com/uploads/1/3/0/6/130621068/824713.pdfIn PDF document text
    • http://diabetesindependence.com/uploads/1/3/0/6/130621589/8081a.pdfIn PDF document text
    • http://pigam.igorlucshii.online/uploads/2020/01/28/f5b05f6b7416.pdfIn PDF document text
    • http://taranakitimebank.nz/uploads/1/3/0/6/130603860/tiduwunekufere_woluj_padasigike_rabasowedif.pdfIn PDF document text
    • http://diomebel.ru/uploads/2020/01/28/wiboxa.pdfIn PDF document text
    • http://flatfeemlsre.com/uploads/1/3/0/6/130621098/jikowo-gujurez.pdfIn PDF document text
    • http://cecilyeiferle.com/uploads/1/3/0/5/130543289/130543289.html#dispute+credit+report+with+equifaxIn PDF document text
    • http://linux.thai.net/projects/fonts-tlwgIn PDF document text
    • http://www.thaitux.infoIn PDF document text

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001320.bin
4a3a2958656865fa9fdc7b7d89659970fbd03247bccb48ef042ef9b576f9c38d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1320 7980 bytes
font_01_sfnt_off000072cd.bin
c7143368894299a997ed09f05024df052d964886bc902d598de4a6791c50751f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x72CD 10292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.