Malicious PDF — malware analysis report

Static analysis result for SHA-256 91074f33d46fe23f…

MALICIOUS

PDF

50.1 KB Authoring application: OpenOffice Draw
MD5: e8c92a2de046a2b2c5713285be81b080 SHA-1: 27be966de94efa3de218c8165a9f7ecd59414f86 SHA-256: 91074f33d46fe23f2860b22a946bf946c55f0a7809f872d50c5f54fb35ac04ae
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs, identified as a 'PDF_SEO_LINK_FARM' heuristic. These links predominantly point to other PDF files hosted on various domains, suggesting a phishing or SEO poisoning campaign. The ML classifier and ClamAV detection further confirm the malicious nature of the file. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9988

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://field-tek.com/uploads/1/3/0/4/130490338/aabeaa495adff.pdf
    • http://120ebaltimore.com/uploads/1/3/0/5/130551089/32723885.pdf
    • http://freelancezone.xyz/uploads/2020/01/28/145200273c2.pdf
    • http://nuttybeepdx.com/uploads/1/3/0/5/130588703/lozexelirom.pdf
    • http://sleepoutlouies.com/uploads/1/3/0/6/130620293/1230150.pdf
    • http://mysp365.com/uploads/1/3/0/2/130272352/mepamijawesojuw_xiniv.pdf
    • http://myludingtontherapy.com/uploads/1/3/0/4/130489070/temutitejo_kajapegunanakuf.pdf
    • http://calljasonmyers.com/uploads/1/3/0/6/130621946/05a25e.pdf
    • https://gufibisara.weebly.com/uploads/1/3/0/3/130380037/zokavoxemivemu-kidagikavuguzo-wosof.pdf
    • http://mysoundcollective.com/uploads/1/3/0/2/130289240/130289240.html#assamese+video+song+free++2019

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013a9.bin
eb700dc148fc302c0aea667fe8e671dfb869c76f70a530c2efc85001277ef520		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13A9 8288 bytes
font_01_sfnt_off00005de8.bin
80c33299320c81568f6bce5f575004607b6a6c0b36da5aa72c9d36ac4e86e521		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5DE8 16304 bytes
font_02_sfnt_off00007304.bin
aa5e818d7804eff6c62ece2a9875642c528c47bd4d08ba7f4dbd82b8513898f2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7304 3832 bytes
font_03_sfnt_off0000818c.bin
96db97a71b3933e9052dbb3e7def9c2c14d78e2357d53e183fd49605ad720bbb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x818C 6484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.