Malicious PDF — malware analysis report

Static analysis result for SHA-256 cfc5889247b484eb…

MALICIOUS

PDF

49.6 KB Authoring application: LibreOffice Draw First seen: 2020-09-24
MD5: 1e4fb47c05f15ba28646544c31ab9c04 SHA-1: cbc22e92299f56bcaf131e587e6df463f835dd8f SHA-256: cfc5889247b484ebf5006e1fbf5889e0b9f0e8f69761d8c7867f325cfe401b15
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files, a technique commonly used for SEO poisoning and phishing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious download intent. The document body also contains a call-to-action phrase, reinforcing the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tomryan.com.au/uploads/1/3/0/2/130272347/gudazam.pdf In PDF document text
    • http://jefufipe.syriabay.com/uploads/2020/01/29/suwisujiz.pdfIn PDF document text
    • http://durhamyouthprograms.org/uploads/1/3/0/6/130605325/nadotutuxato.pdfIn PDF document text
    • http://buecard.com/uploads/1/3/0/6/130605119/doxijudosi.pdfIn PDF document text
    • http://cameronpoydras.com/uploads/1/3/0/6/130604336/9084d4a97e.pdfIn PDF document text
    • http://nikonmalta.com/uploads/1/3/0/4/130435516/xokemomilekabe_toxatolubo.pdfIn PDF document text
    • http://nfldraftdays.com/uploads/1/3/0/5/130588216/wekelo.pdfIn PDF document text
    • http://kootenaycured.com/uploads/1/3/0/2/130289262/4417021.pdfIn PDF document text
    • http://rochesterreadingtutor.com/uploads/1/3/0/2/130272478/1479308e9.pdfIn PDF document text
    • http://myfirstroots.com/uploads/1/3/0/6/130621844/abb24.pdfIn PDF document text
    • http://woodlandstuition.com/uploads/1/3/0/4/130483200/130483200.html#odia+all+singer+album+songIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001235.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1235 8644 bytes
SHA-256: c7b9c5a60712cc1847b237744b7984bd5b2ece824eb8dc99980284a7fda7fd63
font_01_sfnt_off00006065.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x6065 16092 bytes
SHA-256: c6c28444bcd94379862b6cc7f8cfcdbcdaeb026857ccdb099d87626a561054a6
font_02_sfnt_off00007544.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7544 10080 bytes
SHA-256: 3eb52dfc01ad37d8ccbf6cdadee838c8f5e14eee805078d382afdadd92397b4b

Open this report in the interactive analyzer, or submit your own file for analysis.