Malicious PDF — malware analysis report

Static analysis result for SHA-256 840550417bcd7a46…

MALICIOUS

PDF

51.9 KB Authoring application: OpenOffice Draw
MD5: dd005f1db3aca944f99be22885a27a0e SHA-1: cafa05e8a6135247060dfd1f06f8fc67951e1ce4 SHA-256: 840550417bcd7a46cd78328a915eccab5c421125e46ddc96ecc2d518d4574a19
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV. The document body contains numerous embedded URLs pointing to external PDF files hosted on various domains, suggesting a link farm or redirection scheme. The primary purpose appears to be directing users to these external resources, which could be for SEO manipulation or to serve as a distribution point for further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://bazibirelev.weebly.com/uploads/1/3/0/5/130551477/gesoxu.pdf
    • http://zur.tashermer.xyz/uploads/2020/01/28/1553193.pdf
    • https://waparugolu.weebly.com/uploads/1/3/0/3/130323120/1567809.pdf
    • http://shelleywill.com/uploads/1/3/0/3/130313252/e0abe1b3.pdf
    • https://nilorabezifaf.weebly.com/uploads/1/3/0/6/130604939/fogezojutorufe-getetebesawivab.pdf
    • http://der.0406shopps03.fun/uploads/2020/01/27/fufoso.pdf
    • http://royalbeautysupplysalon.com/uploads/1/3/0/4/130479513/wemavagekex.pdf
    • http://michelleprebilic.com/uploads/1/3/0/5/130540211/juzalikelosasoxaw.pdf
    • http://thesunkid.org/uploads/1/3/0/2/130272381/lijawuponakedupaf.pdf
    • http://ruwef.goods-trends.top/uploads/2020/01/29/5238461.pdf
    • http://sirativemu.lechenienarkomanii-kostroma.ru/uploads/2020/01/27/regilar_kufolojugorix.pdf
    • http://janituwur.mansbestfriendmemorial.com/uploads/2020/01/29/zujurizokebuvub.pdf
    • https://sibonutowu.weebly.com/uploads/1/3/0/6/130604979/ce7ac0c84a7f.pdf
    • https://pesawolobebum.weebly.com/uploads/1/3/0/2/130289163/46a3f65.pdf
    • http://bilukozi.02shopppp.fun/uploads/2020/01/29/9354088.pdf
    • http://rod.tomatis-siberia.ru/uploads/2020/01/28/vumenuwisudud_vasulozugekola_jikiditewa.pdf
    • http://multistreams.com/uploads/1/3/0/6/130620424/130620424.html#catch+me+if+you+can+download+dual+audio+720p
    • http://scripts.sil.orgThis
    • http://www.fontrix.comhttp://www.nhncorp.com
    • http://scripts.sil.org/
    • http://scripts.sil.org/OFL
    • http://scripts.sil.org/OFLAbyssinica

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000155a.bin
8e9b7289f53a519f036338d1bd3dfcf59f1249a1f03c240748b0cd90a4baf03c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x155A 9924 bytes
font_01_sfnt_off00006855.bin
cb30ccbe3470e24abea742643761fe43cfe74664858df86eeeab0c9a4c342ab2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6855 20968 bytes
font_02_sfnt_off000087ed.bin
09980af06aa32beede8e777aa10233923e4f4a7e5cc0f889807f36331cd09c44		 pdf-font-stream PDF embedded font (sfnt) at offset 0x87ED 1584 bytes
font_03_sfnt_off00008fbc.bin
e56f5db8faf554166087922806b3819c377976d94af14c6b8a512386de68c265		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8FBC 2056 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.