Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1be41f22f87d2c2…

MALICIOUS

PDF

35.7 KB Authoring application: OpenOffice.org
MD5: 193ca90f46179e6a768ea9d350338989 SHA-1: 50f9878c8a698013b85a25de5fe531fef6aec873 SHA-256: c1be41f22f87d2c2278565a16a996bb6f25ec0f7ab79b6fc1ac27aaadd58549b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, indicating a link farm designed to direct users to potentially malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the 'PDF_SEO_LINK_FARM' heuristic strongly suggest a phishing or traffic redirection scheme. The ML classifier also flagged this file with high confidence.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://momentumwomenscenter.com/uploads/1/3/0/2/130274241/dilozepew.pdf
    • https://najajigegageno.weebly.com/uploads/1/3/0/2/130270903/9768473.pdf
    • http://nstarlight.com/uploads/1/3/0/4/130488513/tiwot.pdf
    • http://getapibipe.bananawear.online/uploads/2020/01/27/lebavowuwejelup.pdf
    • http://fegajed.americanadeidiomas.com/uploads/2020/01/27/7639964.pdf
    • https://kumizadeti.weebly.com/uploads/1/3/0/4/130483428/mokevowu_jigopubunut_zimoxox_donejojepatan.pdf
    • http://newpstowing.com/uploads/1/3/0/2/130273894/107209e.pdf
    • http://puperabid.rosso-levanto.ru/uploads/2020/01/28/ab75901e.pdf
    • http://southwestflaadom.org/uploads/1/3/0/5/130589411/9835976.pdf
    • http://thebannersheet.com/uploads/1/3/0/6/130604286/mozadigulivavulumobe.pdf
    • http://theyogaden.net/uploads/1/3/0/5/130588419/8139294.pdf
    • http://minival.co.uk/uploads/1/3/0/4/130492689/4564701.pdf
    • http://mosewotiga.right-style.ru/uploads/2020/01/27/vixexusezubi_liretupede_mokira.pdf
    • http://bellathevagablond.com/uploads/1/3/0/3/130313213/musoniliwedaxi_riwatoreki_tifatutaj.pdf
    • http://postroisvoydom.ru/uploads/2020/01/28/e852d4f2.pdf
    • http://sapazem.olgadating.pro/uploads/2020/01/28/nunoz.pdf
    • http://athleticsnorth.net/uploads/1/3/0/5/130550914/sezovazutem_kejuj_kigupamukukamo.pdf
    • http://acouturelife.com/uploads/1/3/0/6/130621805/130621805.html#albedo+overlord+wallpaper+android

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000154f.bin
f741bc8a992875fd37ed601fd150acacfed424278ea1a6d4bd0701adc42fb533		 pdf-font-stream PDF embedded font (sfnt) at offset 0x154F 8664 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.