Malicious PDF — malware analysis report

Static analysis result for SHA-256 938140578f435b8c…

MALICIOUS

PDF

50.0 KB Authoring application: OpenOffice Draw
MD5: da5e3defd7cb7a530ee36aeebdecbec7 SHA-1: 7352bd67a2158a8d8e84e473e8fc90f41bc47e55 SHA-256: 938140578f435b8cd1e9acdb91ea703173467cf5ba7cf19b6572ba25550d8a14
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies the mass linking behavior, with 'starcustomsgr.com' being a dominant host for these links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://starcustomsgr.com/uploads/1/3/0/6/130605406/seteput-padisag-buwosis.pdf
    • http://mobiledevblog.com/uploads/1/3/0/5/130551091/jejurodutisewul-sawiwafitebux-tirasegixegu-fomaseg.pdf
    • http://thelotuscast.com/uploads/1/3/0/5/130588550/6760342.pdf
    • http://muslimsjobs.com/uploads/1/3/0/7/130775137/7445492.pdf
    • http://wildstreamstudio.net/uploads/1/3/0/5/130539048/2a4a025fd6286.pdf
    • http://bardgames.org/uploads/1/3/0/5/130540172/d41067a1edac4a8.pdf
    • http://hardknot.com/uploads/1/3/0/7/130738534/4007853.pdf
    • http://personalinjurylawyersandiego.net/uploads/1/3/0/6/130639426/3247163.pdf
    • http://amoagallery.com/uploads/1/3/0/7/130740200/wafomuz-bigide.pdf
    • http://thewindsorcontractors.com/uploads/1/3/0/4/130490643/cf8f1773edcb9ed.pdf
    • http://blackbeardmarketing.com/uploads/1/3/0/7/130739328/gitetiro-beniveruditug-jeladejurogotu-tesuliwizowumu.pdf
    • http://vadisuit.com/uploads/1/3/0/7/130739369/82fe6.pdf
    • http://hhhconsultingllc.com/uploads/1/3/0/6/130622032/95bb9.pdf
    • http://mitchelangelo.de/uploads/1/3/0/6/130604247/sewuwukefiju.pdf
    • http://agapemedped.com/uploads/1/3/0/6/130639155/vufasu-jalinunoteku-jeforil-xamurisufav.pdf
    • http://triosreadydentallaboratory.com/uploads/1/3/0/7/130775047/kasepekubaru-pepuka.pdf
    • http://doylestownbotox.com/uploads/1/3/0/7/130739006/bidudoririletas.pdf
    • http://sheffieldcctvsystems.com/uploads/1/3/0/2/130291572/4820321.pdf
    • http://hewhodieswiththemostrunswins.com/uploads/1/3/0/4/130435582/noxemimes.pdf
    • http://bfreshcreative.com/uploads/1/3/0/2/130271073/2485673.pdf
    • http://overcomeexercisefears.com/uploads/1/3/0/5/130588668/9905908.pdf
    • http://xinli88wangshangyule.br3h.com/uploads/1/3/0/5/130551343/130551343.html#alamofireimage+alamofire+5

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001099.bin
dc9ba6d98d9dce957f4168e70b0739db179875526dcf1bff6e29914ade0af1c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1099 8976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.