Malicious PDF — malware analysis report

Static analysis result for SHA-256 ddc22623a58ff88a…

MALICIOUS

PDF

55.1 KB Authoring application: LibreOffice First seen: 2020-09-24
MD5: d41155491733674eda35ff59f3e852eb SHA-1: effe5b637ad274605872406c711cba0a51ea858a SHA-256: ddc22623a58ff88a3fa74de4aec2bd0d850b7b05366a7c8750725be4768b1a49
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also flag this as malicious phishing content. The embedded URLs likely lead to further malicious content or exploits. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://zebsvedlund.com/uploads/1/3/0/2/130292098/d16d6c.pdf In PDF document text
    • http://astrots.com/uploads/1/3/0/5/130589045/24b51b2b.pdfIn PDF document text
    • http://elpcarpetcleaners.com/uploads/1/3/0/2/130270934/tegapubozawutovuw.pdfIn PDF document text
    • https://vufomowukabatij.weebly.com/uploads/1/3/0/4/130488512/3daf7ab7ad3d2f7.pdfIn PDF document text
    • http://thegoldenstateacademyschoolofspeechanddebate.com/uploads/1/3/0/6/130604903/6067427.pdfIn PDF document text
    • http://hotsipa.com/uploads/1/3/0/6/130620902/6819497.pdfIn PDF document text
    • http://mijnbiologie.weebly.com/uploads/1/3/0/5/130540211/jadasomoko.pdfIn PDF document text
    • http://rak.love-farma.net/uploads/2020/01/28/befugibiwela.pdfIn PDF document text
    • http://kefofekawa.bslg.ru/uploads/2020/01/28/fenigagodotinu.pdfIn PDF document text
    • http://brundikoutek.weebly.com/uploads/1/3/0/6/130639217/xupozibilelanojofa.pdfIn PDF document text
    • https://radozugenapu.weebly.com/uploads/1/3/0/3/130323594/3494465.pdfIn PDF document text
    • http://coachinginyourcloset.com/uploads/1/3/0/3/130313585/5a0b5da0e7e.pdfIn PDF document text
    • http://krankengymnastik-steglitz.de/uploads/1/3/0/5/130539795/3641276.pdfIn PDF document text
    • http://themaacfitness.com/uploads/1/3/0/4/130477414/9790270.pdfIn PDF document text
    • http://mrstoombs2ndgrade.weebly.com/uploads/1/3/0/5/130588895/2114845.pdfIn PDF document text
    • http://mrmojo.com.br/uploads/1/3/0/3/130313700/rinanekeberuz_bikafi.pdfIn PDF document text
    • http://frackfreefoothills.org/uploads/1/3/0/6/130620962/826ba.pdfIn PDF document text
    • http://wodimo.service-dnr.ru/uploads/2020/01/27/8536067.pdfIn PDF document text
    • http://timejulora.belvit.by/uploads/2020/01/28/rigefaxazafed-tofagibajapub-buxun.pdfIn PDF document text
    • http://myloveclub.ru/uploads/2020/01/27/0c2e9c7adc.pdfIn PDF document text
    • https://zexupimifosirof.weebly.com/uploads/1/3/0/5/130543476/f9d7b2e.pdfIn PDF document text
    • http://gaxukagabe.psk-es.ru/uploads/2020/01/27/d428b634528.pdfIn PDF document text
    • http://troitsa-ld.ru/uploads/2020/01/28/e9e5c0da05e.pdfIn PDF document text
    • http://youandyourcareer.org/uploads/1/3/0/5/130589393/12bef5b638ce.pdfIn PDF document text
    • http://kkmediation.com/uploads/1/3/0/6/130603904/4332582.pdfIn PDF document text
    • http://reliancemartialarts.com/uploads/1/3/0/6/130620456/130620456.html#simple+interest+and+compound+interest+all+formulasIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text

Related samples 4

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001209.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1209 9676 bytes
SHA-256: dcf2439b40cbcf11dc6b4aee2069210581ca61b9589919db4812beede5447ee4
font_01_sfnt_off00009078.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x9078 16036 bytes
SHA-256: 779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63

Open this report in the interactive analyzer, or submit your own file for analysis.