Malicious PDF — malware analysis report

Static analysis result for SHA-256 93afe6f84d5d93f4…

MALICIOUS

PDF

51.6 KB Authoring application: LibreOffice Draw
MD5: 27ba89754f3656df7756fe42689f0cd1 SHA-1: d2ae96dadce9678b09fc35e310925eb1238e9962 SHA-256: 93afe6f84d5d93f48144df78920ebfee6195fc0700e11c0facb7a47e9a14990b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was identified as malicious by ClamAV and an ML classifier, and it contains a large number of embedded URLs. The heuristic PDF_SEO_LINK_FARM indicates a link farm, suggesting the primary purpose is to redirect users to potentially malicious content. The embedded URLs are the highest priority IOCs for further investigation.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9992

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gegi.iivii.icu/uploads/2020/01/28/wanewogelaje.pdf
    • http://vodkaveritas.co.uk/uploads/1/3/0/4/130489131/5156810.pdf
    • http://mjrblogspot.com/uploads/1/3/0/6/130639249/927f7f3416f7cf0.pdf
    • http://metropolis-exc.com/uploads/1/3/0/5/130589308/5073419.pdf
    • http://bosslessforever.com/uploads/1/3/0/5/130590432/namikeg.pdf
    • http://mjlpa.us/uploads/1/3/0/5/130550828/6558325.pdf
    • http://nbc-heads-up-poker.com/uploads/1/3/0/5/130551309/lesamujupexilisuxefi.pdf
    • http://investedin.net/uploads/1/3/0/4/130488470/7516345.pdf
    • http://drinkresponsively.net/uploads/1/3/0/5/130551653/5825053.pdf
    • http://cherry-supply.com/uploads/1/3/0/6/130639760/876d93e84.pdf
    • http://oaklandempowermentscholarshipprogram.com/uploads/1/3/0/6/130640020/nefoporivupuwanebewo.pdf
    • http://us.momotombochocolatefactory.com/uploads/1/3/0/3/130324050/130324050.html#single+phase+half+wave+controlled+rectifier+with+freewheeling+diode

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012bc.bin
bd1b3ac3eb6807f5629700e48a5f54828555ef9d18a99aa62beca3e715a4f5c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12BC 7656 bytes
font_01_sfnt_off000065c3.bin
750c92fa1db5810c6de6b1040e9c0837d38486580b44de1cde3f2eb8b8040d63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x65C3 6664 bytes
font_02_sfnt_off0000763b.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x763B 16036 bytes
font_03_sfnt_off00008a81.bin
e6c4fff7e6904223d3c872f274e45ade824ed67bae4a9136195182399b8a411a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8A81 3884 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.