Malicious PDF — malware analysis report

Static analysis result for SHA-256 80dec4f365b361c1…

MALICIOUS

PDF

36.5 KB Authoring application: LibreOffice
MD5: ea430c0cf8f5d4ef99fc9ddae69434ab SHA-1: aa4cf9d31eec8dbdc87c7e0ee6c1518faa831a00 SHA-256: 80dec4f365b361c199ad121d971d01945ed914d0cc6aafee222f26d8c8659683
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a mass of external links to other PDF files, identified as a link farm. The presence of a 'Click here to download' lure, combined with the numerous external PDF links, strongly suggests a phishing or malware distribution attempt. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports this malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nexuspointrecordings.net/uploads/1/3/0/6/130620807/fogosok.pdf
    • http://balticsportsciencesociety.com/uploads/1/3/0/5/130551144/lidegiwowuv_segege_degiguj_tituxedozole.pdf
    • http://onixpic.ru/uploads/2020/01/29/xufudelesuzef.pdf
    • http://amitsheth.net/uploads/2020/01/29/3570408.pdf
    • https://wagefelom.weebly.com/uploads/1/3/0/2/130287971/luzitogeji.pdf
    • https://soxopuzaxus.weebly.com/uploads/1/3/0/4/130476183/wapalinirukun-wugolatarog-surevabirebas.pdf
    • http://specodegda-kemerovo.ru/uploads/2020/01/28/vozoxolazaj.pdf
    • http://peninsulafilmfestival.com/uploads/1/3/0/6/130605097/277594259e08.pdf
    • https://vimuzizop.weebly.com/uploads/1/3/0/2/130272438/dufanifudajosaj.pdf
    • http://doug-jones.com/uploads/1/3/0/3/130379326/jobotozenironuf.pdf
    • http://streetbrunch.com/uploads/1/3/0/6/130620478/zabavugib.pdf
    • http://desirapesta.us/uploads/1/3/0/4/130435553/130435553.html#machining+time+calculation+excel+sheet

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001309.bin
e19aa7faebdf3d7db1dc1fbbc9c76132ffc3801571b5d011b7a5348f7bd5aabd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1309 8304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.