Malicious PDF — malware analysis report

Static analysis result for SHA-256 87e2fa05cdd68c65…

MALICIOUS

PDF

40.0 KB Authoring application: OpenOffice.org First seen: 2020-07-24
MD5: beed18170b250d1df756d3061b48ed01 SHA-1: ff18a7f3cc21791ca8f91a269c2e2cd08f9f85a3 SHA-256: 87e2fa05cdd68c659030554acec5f257c7dbb672202901f40c0d05f5f362ffd2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links likely serve to distribute further malicious content or redirect users to phishing sites. The ML classifier and ClamAV detection strongly indicate malicious intent, consistent with a phishing or malware distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://leffet.fr/uploads/1/3/0/8/130813846/7ebbcbcd6992a49.pdf In PDF document text
    • http://drgnzombiestournament.com/uploads/1/3/0/5/130551536/xavenif.pdfIn PDF document text
    • http://branchettastreasures.com/uploads/1/3/0/7/130775195/jaxuri-jaxegexorise.pdfIn PDF document text
    • http://misssupremepurityqueen.com/uploads/1/3/0/6/130640199/nulubobax-roronu.pdfIn PDF document text
    • http://mydiabbyhc.com/uploads/1/3/0/5/130590371/xozob.pdfIn PDF document text
    • http://www.looksbeautyandnails.nl/uploads/1/3/0/7/130776428/9d6fb.pdfIn PDF document text
    • http://nsolc.com/uploads/1/3/0/5/130588256/674510.pdfIn PDF document text
    • http://trentriverdesigns.com/uploads/1/3/0/2/130272481/8d46eb5c7c7.pdfIn PDF document text
    • http://nomegasitehere.com/uploads/1/3/0/6/130604213/8171520.pdfIn PDF document text
    • http://zo2yd.slpny.com/uploads/1/3/0/2/130272395/4fcde4f2dc7917.pdfIn PDF document text
    • http://welcomeneighborftsmith.com/uploads/1/3/0/7/130740342/2af3fbf1.pdfIn PDF document text
    • http://carbonneutralnetworks.com/uploads/1/3/0/7/130738732/jadubimo-ketazapejoz-nesuv-bojumagibivisaw.pdfIn PDF document text
    • http://elysianresources.net/uploads/1/3/0/5/130588457/morerevebet.pdfIn PDF document text
    • http://sacramentoyardcare.com/uploads/1/3/0/9/130969338/2b03be6c850993.pdfIn PDF document text
    • http://555-jeudirouge.fr/uploads/1/3/0/5/130590395/3474205.pdfIn PDF document text
    • http://mydmdesign.com/uploads/1/3/0/6/130603887/bijideraxezu.pdfIn PDF document text
    • http://radio-pictures.com/uploads/1/3/0/6/130604723/xaxirufuto.pdfIn PDF document text
    • http://geras.sk/uploads/1/3/0/2/130288444/novur-zokipunuruj-fididetozumopum.pdfIn PDF document text
    • http://txa4d.com/uploads/1/3/0/8/130874179/mebowaladus-pifiba-molili.pdfIn PDF document text
    • http://prosepia.com/uploads/1/3/0/5/130550833/130550833.html#gamepro+magazine+pdfIn PDF document text
🗂 Part of campaign: aurasalontn.com 5 samples

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003f2c.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3F2C 7552 bytes
SHA-256: c64d4d95afae35640df4a0d335f81b1b869e4587b2e3f5fff2bed4adc4d4e563