Malicious PDF — malware analysis report

Static analysis result for SHA-256 b31655b6b117375b…

MALICIOUS

PDF

43.6 KB Authoring application: OpenOffice Draw
MD5: dbba28266f4c731892bd100818428891 SHA-1: b0127c9f74db1fc16b0f6abf86c0ff1f142483ad SHA-256: b31655b6b117375bcc8cc6fb68b6a861f5e56d4826669c8248913ed26e6b59f9
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML_NYX_PDF_MALICIOUS and ClamAV detections further confirm its malicious nature. The primary intent appears to be redirecting users to a network of potentially malicious or phishing-related content hosted on various domains.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mejazufe.zonaspasalon.ru/uploads/2020/01/29/8441854.pdf
    • http://xexi.photorobots.com/uploads/2020/01/28/9cd5cc1d72.pdf
    • https://kurobiso.weebly.com/uploads/1/3/0/2/130270921/73b1584f4dba.pdf
    • https://kitasomoma.weebly.com/uploads/1/3/0/5/130541552/4ac9992772cd.pdf
    • http://caninesareforever.com/uploads/1/3/0/5/130551055/d6b3b68dfb30525.pdf
    • http://luzukaviv.javaprog.online/uploads/2020/01/28/8681873.pdf
    • http://rmtdesigngroup.com/uploads/1/3/0/4/130489143/nupelezanugupuv_jikamosofan_nezatagudarimir.pdf
    • http://cheshireneuroactive.org/uploads/1/3/0/3/130379061/5890014.pdf
    • http://apexfrontier.com/uploads/1/3/0/6/130605420/fobanisasupusar_kasifepa_siveken.pdf
    • http://nonsmobizna.weebly.com/uploads/1/3/0/6/130640053/jerolifeluxol.pdf
    • http://angiemoll.com/uploads/1/3/0/2/130274301/gifix-dusolunori-zolafolivopas-butevokejolam.pdf
    • http://clavesparatusalud.com/uploads/1/3/0/4/130489168/misadowewo.pdf
    • https://mozikado.weebly.com/uploads/1/3/0/3/130323115/sojolaxexaniv-wusigixareguk-nunagupopi.pdf
    • http://tos.dobrusin.pro/uploads/2020/01/29/8181070.pdf
    • http://suxavuj.tamita-tami.pro/uploads/2020/01/27/bavonexav.pdf
    • http://kuwasutewe.jornalcaleidoscopio.com/uploads/2020/01/27/77c1a5a47.pdf
    • http://michkah.com/uploads/1/3/0/2/130272516/5149928.pdf
    • http://ziwile.party.su/uploads/2020/01/28/af04a9081.pdf
    • http://tijuwuxe.periodismo-news.com/uploads/2020/01/29/7926d3733be4331.pdf
    • http://angiemoll.com/uploads/1/3/0/2/130287457/jipekarivose_romepes_kisiwoxozobefi_lokewuwa.pdf
    • http://juvo.terraeuropa.net/uploads/2020/01/28/wumonaxajafebof.pdf
    • http://terraeuropa.net/uploads/2020/01/27/febab-dudanugovajegoz-kusutevebi.pdf
    • http://woxuraxud.onemagazin-sveta.ru/uploads/2020/01/28/4923865.pdf
    • http://miracleinabucket.com/uploads/1/3/0/6/130621847/130621847.html#beats+audio+installer+root+pro+apk
    • http://angiemoll.com/uploads/1/3/0/2/1302

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001b62.bin
6f92a796c890a1048031b5bee785d349e1fbd6b048d4602b26e13e4ee8143645		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1B62 13940 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.