Malicious PDF — malware analysis report

Static analysis result for SHA-256 a82b5e6eab1a1843…

MALICIOUS

PDF

39.2 KB Authoring application: LibreOffice Draw First seen: 2020-08-25
MD5: 6dd214bd4fb8ad541867804da726b9b2 SHA-1: 4870f35156e894631978ad12ec6cd6276d4c3d21 SHA-256: a82b5e6eab1a18431820463f13adfa3e37bc2335e7c1bdca528fb390b4a48824
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or redirection campaign. The ClamAV detection further supports its malicious nature. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://voraginedeescritores.com/uploads/1/3/0/7/130738735/vewuzoba.pdf In PDF document text
    • http://www.einslearningcenter.com/uploads/1/3/0/8/130815009/2582632.pdfIn PDF document text
    • http://makeitwordpress.com/uploads/1/3/0/6/130604049/kumuneg.pdfIn PDF document text
    • http://lotusmediaprint.com/uploads/1/3/0/5/130551140/6863692.pdfIn PDF document text
    • http://pelicanstl.com/uploads/1/3/0/5/130539657/7377466.pdfIn PDF document text
    • http://soundnotion.tv/uploads/1/3/0/7/130739935/vipevolatizigevovini.pdfIn PDF document text
    • http://modernwomantour.com/uploads/1/3/0/5/130540604/pofufisilatum.pdfIn PDF document text
    • http://baileyjohall.com/uploads/1/3/0/7/130776222/00cc7809481.pdfIn PDF document text
    • http://www.hellotherepr.com/uploads/1/3/0/7/130738805/1764664.pdfIn PDF document text
    • http://cpoaklandpresentation.com/uploads/1/3/0/5/130590413/35aa61ee8c5a.pdfIn PDF document text
    • http://acmehempcompany.com/uploads/1/3/0/7/130739764/botezatu_wazobew_joxafuwumadi_tifajefamivirat.pdfIn PDF document text
    • http://anatoly-nikolsky.com/uploads/1/3/0/5/130551554/299971.pdfIn PDF document text
    • http://nourishsinglemoms.org/uploads/1/3/0/8/130813648/zobutironufes_juwokozugomul.pdfIn PDF document text
    • http://directcarenepal.org/uploads/1/3/0/2/130273987/7270e.pdfIn PDF document text
    • http://mrsjessinaanderson.com/uploads/1/3/0/8/130813988/bovobiwonivokap-golosoridelu-jisofolovuti.pdfIn PDF document text
    • http://smokinjoes.net/uploads/1/3/0/9/130969266/demukip-tojibopokuxu.pdfIn PDF document text
    • http://londyn.letenky-sky.sk/uploads/1/3/0/7/130775503/dojesujaw-welifujabug-robivisazuk.pdfIn PDF document text
    • http://www.unnamedclothing.com/uploads/1/3/0/6/130604583/ec3a7c0f9bbf6.pdfIn PDF document text
    • http://www.mbkenyatrip17.com/uploads/1/3/0/7/130776561/16845.pdfIn PDF document text
    • http://islamic-global.net/uploads/1/3/0/3/130313155/sugotukuzotij-fijibetiratuno-pijiw-zotumexisodep.pdfIn PDF document text
    • http://kennedyatlibrarysquare.com/uploads/1/3/0/5/130544468/funudixudifefipubuk.pdfIn PDF document text
    • http://moirarogers.net/uploads/1/3/0/4/130436054/0d7d729a79f2.pdfIn PDF document text
    • http://mr-riks.com/uploads/1/3/0/5/130588827/juxikenutiguv_xomugiwajixu_vulesum_vulatomaka.pdfIn PDF document text
    • http://onlinesmdc.com/uploads/1/3/0/5/130543028/130543028.html#aadhar+card+date+of+birth+change+gazetted+officer+formatIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000028c1.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x28C1 2652 bytes
SHA-256: e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea
font_01_sfnt_off00003491.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x3491 8396 bytes
SHA-256: 4b93d17b2fa5cc33452931b5738f4c3642715a757437d7e57d0eec9d3ffad324

Open this report in the interactive analyzer, or submit your own file for analysis.