Malicious PDF — malware analysis report

Static analysis result for SHA-256 c7670d473e3dc0fb…

MALICIOUS

PDF

45.7 KB Authoring application: LibreOffice Draw
MD5: 3fc67b613ac82fc8b2cf712d1fae4774 SHA-1: c9af2b096993abcc7507683b32d03ccd42dcfcda SHA-256: c7670d473e3dc0fb75edb555e78ab65819adf2cbef0a4a9b337303d97961d87b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of a link farm or redirection scheme, likely intended to lead the user to malicious content or phishing sites. The ClamAV detection as Pdf.Dropper.Agent-7849848-0 further supports its malicious nature. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Dropper.Agent-7849848-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Dropper.Agent-7849848-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://zixeratime.master46.pro/uploads/2020/01/27/27eb5f9bdab912.pdf
    • http://mlhubbard.com/uploads/1/3/0/5/130588633/4803527.pdf
    • http://survivingmytwentysomethings.com/uploads/1/3/0/4/130489220/9944.pdf
    • http://mabuzifo.paypal-support.bz/uploads/2020/01/29/eda0e4ea73487eb.pdf
    • https://ravupamorepa.weebly.com/uploads/1/3/0/5/130590481/648361.pdf
    • http://whatthesaintsknew.org/uploads/1/3/0/6/130639729/gudalanix-rovozesoduduper-kolejisurixag.pdf
    • http://bringontheagame.com/uploads/1/3/0/5/130544625/jazixeze_resinaw_mezenawa_nevotokovel.pdf
    • http://pennington-automotive.com/uploads/1/3/0/4/130490277/mabisipinu_semuverobupova_xisigetizepol_kaxakawape.pdf
    • http://petersonskattumrealtygroup.com/uploads/1/3/0/3/130379074/130379074.html#briquette+making+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000125e.bin
bce1c851c39cea0238ccacaddb8b7eb3b3f072e599093dcc0b5eef8577d2b6d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x125E 8412 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.