Malicious PDF — malware analysis report

Static analysis result for SHA-256 cf4b2aa4482041ee…

MALICIOUS

PDF

36.9 KB Authoring application: LibreOffice Draw
MD5: f46235482c546107184a7f905cda66b8 SHA-1: 2481415f1c7a3624e4e6ee4b348e9124f0a13e86 SHA-256: cf4b2aa4482041ee50db1995d78219a16996f4ecf5f01f4e82f8a56a20128137
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as flagged by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection further support the malicious nature of this file. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://piranhamagazine.com/uploads/1/3/0/5/130589433/8959585.pdf
    • http://elrinteriors.com/uploads/1/3/0/2/130274256/832848.pdf
    • http://elmoshade.com/uploads/1/3/0/4/130476427/bc31de7.pdf
    • http://patriziocontemporary.com/uploads/1/3/0/2/130270742/e8b32be.pdf
    • http://oaklandpoolcare.com/uploads/1/3/0/7/130739538/6069248.pdf
    • http://www.minnowmanmedia.com/uploads/1/3/0/6/130639975/pazexekov.pdf
    • http://akysora.com/uploads/1/3/0/7/130740184/deruzobi_puzurefe_gujepar_xifabajeru.pdf
    • http://funelectron.com/uploads/1/3/0/7/130775747/5779014.pdf
    • http://nowaysir.com/uploads/1/3/0/7/130776075/xunutepokokune.pdf
    • http://ahotel.life/uploads/1/3/0/2/130288318/e408ffc716a7a64.pdf
    • http://bevingroup.com/uploads/1/3/0/5/130542773/8cc4c.pdf
    • http://nestingnet.com/uploads/1/3/0/2/130289480/af999fd3d2f6.pdf
    • http://www.blueknightswi2.com/uploads/1/3/0/2/130272424/bakotukosewoba.pdf
    • http://truckwingsdev.com/uploads/1/3/0/6/130604307/a76db.pdf
    • http://jordanlosesweight.com/uploads/1/3/0/4/130478210/e066bb8.pdf
    • http://bodycentralassignee.com/uploads/1/3/0/3/130313471/9146970.pdf
    • http://www.action-speak-louder.com/uploads/1/3/0/6/130620268/gopodajuteripalag.pdf
    • http://graysystemsinc.com/uploads/1/3/0/8/130873930/bewejuf.pdf
    • http://morganrv.com/uploads/1/3/0/4/130476075/nidabawomowam.pdf
    • http://bifemecanico.com/uploads/1/3/0/3/130313323/semiveguxedujigiwalo.pdf
    • http://www.teosandwiches.com/uploads/1/3/0/6/130604820/5976496.pdf
    • http://oldtowndoggiewash.com/uploads/1/3/0/8/130874433/fiboz.pdf
    • http://osmosistours.com/uploads/1/3/0/7/130738732/2771384.pdf
    • http://rct2f6.bdgct.com/uploads/1/3/0/6/130639173/130639173.html#contrastive+analysis+theory+of+language+learning
    • http://bevingroup.com/uploads/1/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f31.bin
11b233713c7be20913786034a64fc0816d5bd89aeb5e8e0de811751e23af2aef		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F31 7528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.