Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f8f77f7361f564b…

MALICIOUS

PDF

39.6 KB Authoring application: OpenOffice.org First seen: 2020-09-07
MD5: 89d0d793d1c4c6cffc96cca794c52705 SHA-1: 67371e4d08b50be3cb04256d111e6798c0be7c81 SHA-256: 7f8f77f7361f564bd77fda5023f4a5b45df93ba1a879f99a6083d37ebf3cb3d7
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or SEO poisoning attack, designed to drive traffic to malicious content. The ClamAV detection and ML classifier further support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rendopoly.com/uploads/1/3/0/5/130588202/4880c18ae4df373.pdf In PDF document text
    • http://jenn4judge.com/uploads/1/3/0/5/130545557/migofodupuboba-jufonuz.pdfIn PDF document text
    • http://pivotingdigital.com/uploads/1/3/0/2/130272327/93d857.pdfIn PDF document text
    • http://aworldinneed.org/uploads/1/3/0/4/130491757/wosamaferogorosopig.pdfIn PDF document text
    • http://razorodav.brgymahabangparang.com/uploads/2020/01/28/vozoforugux-rulibodafuj-rekavopiji.pdfIn PDF document text
    • http://kzcoinex.com/uploads/2020/01/28/jenonalozibaf.pdfIn PDF document text
    • http://metallicblackrecords.com/uploads/1/3/0/2/130270811/gofivavep-bomutusexofejo.pdfIn PDF document text
    • http://544gorhamroad.com/uploads/1/3/0/4/130490444/koxek-baxipoxegep.pdfIn PDF document text
    • http://genavuv.mbsmun.site/uploads/2020/01/28/fawepurogoj.pdfIn PDF document text
    • http://jinufelin.alfavent.info/uploads/2020/01/29/6834688.pdfIn PDF document text
    • http://onlinehomemyaccsupport706.com/uploads/1/3/0/4/130490399/130490399.html#pokemon+entei+movie+free+onlineIn PDF document text

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012cc.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x12CC 8792 bytes
SHA-256: 09e22a7a1fca33a2bcb62e64ab39f2e888ab2e5aa6e1a4649c41529f35057551

Open this report in the interactive analyzer, or submit your own file for analysis.