Malicious PDF — malware analysis report

Static analysis result for SHA-256 d24d805edef3349f…

MALICIOUS

PDF

47.7 KB Authoring application: LibreOffice
MD5: b7effac28b9375e93804a4dfe65927d2 SHA-1: cbefa30970a24d9ac9ce4076456de4baa5d3b390 SHA-256: d24d805edef3349f6ef1414059250aa8e8c4e16ead3fcaff9befd8cd8c6eef82
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF contains a large number of embedded URLs pointing to external PDF files, a technique often used for SEO spam or to distribute malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically flags this behavior, indicating a mass external link farm. ClamAV also detected this file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', further supporting a malicious intent. No scripts were extracted, so the primary attack vector appears to be the redirection to external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jitorevov.lek.moscow/uploads/2020/01/29/xusamagusif.pdf
    • http://fibes.marketing-digital.ru/uploads/2020/01/28/b41d8baf62.pdf
    • http://renewair.org/uploads/1/3/0/4/130476485/lebututopuvot.pdf
    • http://taza.techindulgence.com/uploads/2020/01/28/vokebopusisiviveno.pdf
    • http://mogafabun.minzdravua.club/uploads/2020/01/28/8e498d989f62de.pdf
    • http://contractgovernmentservices.com/uploads/1/3/0/4/130476346/f376fd3eb57.pdf
    • https://gafojagitaw.weebly.com/uploads/1/3/0/4/130483584/7093893e3f766.pdf
    • http://myultimatecuts.com/uploads/1/3/0/5/130588875/4988951.pdf
    • https://wudoruba.weebly.com/uploads/1/3/0/4/130435941/497003.pdf
    • https://jugajilir.weebly.com/uploads/1/3/0/4/130479350/xuxozuk.pdf
    • https://wafunelitidiko.weebly.com/uploads/1/3/0/5/130541133/394385.pdf
    • http://431775997417950473.com/uploads/1/3/0/3/130313445/545e9b4d28b615.pdf
    • http://theghosttours.com/uploads/1/3/0/5/130539437/9083643.pdf
    • http://like-ball.com/uploads/2020/01/27/6719602.pdf
    • https://mixaporuwore.weebly.com/uploads/1/3/0/5/130550679/mobemejurexawaraji.pdf
    • http://folipazure.ts3update.info/uploads/2020/01/28/e0cf87c569b7fc.pdf
    • https://welexuzofom.weebly.com/uploads/1/3/0/2/130272579/2120826.pdf
    • http://phraseologychoir.com/uploads/1/3/0/5/130588718/xagovamakirago.pdf
    • http://mariya-kudriashova.com/uploads/2020/01/27/ccb4e654f583504.pdf
    • https://zaverumejas.weebly.com/uploads/1/3/0/3/130379581/wefigeborejel.pdf
    • http://fef.luckypays.com/uploads/2020/01/29/5d9b53b134f.pdf
    • http://ludog.startyachting.ru/uploads/2020/01/27/sajumif-zusazigidoze-fulonex.pdf
    • http://bunetili.oracul.pro/uploads/2020/01/27/tazevitezukaxebelaw.pdf
    • http://jajutupux.powking1.ru/uploads/2020/01/28/fokufuvedum-forasema-bafudok.pdf
    • http://bakeline.ca/uploads/1/3/0/5/130539496/130539496.html#yamaha+thr10+patches
    • http://ludog.startyachting.ru/uploads/2020/01/27/sajumif-zusazig

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001905.bin
f3dbf5b62bcf182ec73779f15fd936eaa44c1d07ca4b4370ef1ee725cd77abb9
pdf-font-stream PDF embedded font (sfnt) at offset 0x1905 9408 bytes
font_01_sfnt_off0000734b.bin
6db2f878e0fd57d3a351d0d81a5ccd7b58f68df6728dadc3aee3ebeb1a1d6e60
pdf-font-stream PDF embedded font (sfnt) at offset 0x734B 16068 bytes