Malicious PDF — malware analysis report

Static analysis result for SHA-256 eef31751d2d817b7…

MALICIOUS

PDF

46.4 KB Authoring application: OpenOffice Draw First seen: 2020-09-24
MD5: c21366a0e036fb03281c04427e1031f9 SHA-1: bc599cae20c57804ee5ea3aed4a62234a26e21d2 SHA-256: eef31751d2d817b7a77c31dd91f4c0a8100a68fd55beff079319e9ad7b6813f2
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files hosted on various domains, a technique often used for SEO manipulation or to distribute malicious content. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a machine learning model assigned a high probability of maliciousness. The document body is heavily obfuscated and unreadable, providing no direct clues to the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cloudiso9001.com/uploads/1/3/0/4/130435972/relirurijiwasutifik.pdf In PDF document text
    • http://www.tiffanyhorticulture.com/uploads/1/3/0/7/130740128/98b4176.pdfIn PDF document text
    • http://peoplefollowingjesusworldwide.org/uploads/1/3/0/7/130776344/bedadekibuvowov.pdfIn PDF document text
    • http://colormeribbons.com/uploads/1/3/0/2/130288830/bumisevowuliposog.pdfIn PDF document text
    • http://insrtagam.com/uploads/1/3/0/2/130272573/witugekisexaf.pdfIn PDF document text
    • http://vancouvervideopro.com/uploads/1/3/0/6/130621771/votoxupalatatajexan.pdfIn PDF document text
    • http://landforsaleinlafayettecountyms.com/uploads/1/3/0/4/130491488/9efdd3.pdfIn PDF document text
    • http://learninator.net/uploads/1/3/0/7/130775840/matakibukobega.pdfIn PDF document text
    • http://collectifcontraceptionliege.com/uploads/1/3/0/6/130621387/9336042.pdfIn PDF document text
    • http://artiespectorsucks.com/uploads/1/3/0/5/130590163/zoripuvosatekix.pdfIn PDF document text
    • http://mississippi-ted.com/uploads/1/3/0/2/130291358/rewaratifo.pdfIn PDF document text
    • http://pinellasfootsolutions.com/uploads/1/3/0/6/130620232/1471476.pdfIn PDF document text
    • http://www.danielsaline.com/uploads/1/3/0/4/130488506/cd5a51a4975.pdfIn PDF document text
    • http://occultaluna.co.uk/uploads/1/3/0/7/130775052/gigapega-kovaduw-sadog.pdfIn PDF document text
    • http://reedbailey.net/uploads/1/3/0/8/130874467/vusebudusokeveb.pdfIn PDF document text
    • http://257bennettstreet.com/uploads/1/3/0/3/130313088/2744271.pdfIn PDF document text
    • http://vinemusicstudio.com/uploads/1/3/0/6/130620555/1e5e10278ca17.pdfIn PDF document text
    • http://www.tekq.com.tw/uploads/1/3/0/3/130323329/tudojuk.pdfIn PDF document text
    • http://kenichiasai.com/uploads/1/3/0/6/130640200/1710229.pdfIn PDF document text
    • http://catscardsandcoffee.com/uploads/1/3/0/7/130739520/wopukeziw.pdfIn PDF document text
    • http://mikewilbanks.com/uploads/1/3/0/7/130775983/8326925.pdfIn PDF document text
    • http://chocolaticity.net/uploads/1/3/0/7/130738997/2806517.pdfIn PDF document text
    • http://logicaasesores.com/uploads/1/3/0/8/130813869/janopisomuveruv.pdfIn PDF document text
    • http://courtneyscorner89.com/uploads/1/3/0/6/130604355/jigawopavamape-magafopepapi-wedox.pdfIn PDF document text
    • http://chiavantage.com/uploads/1/3/0/2/130288348/eea58beab63009.pdfIn PDF document text
    • http://safekidskalamazoo.org/uploads/1/3/0/7/130776174/130776174.html#organiza%C3%A7%C3%A3o+da+administra%C3%A7%C3%A3o+p%C3%BAblica+de+angola+pdfIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004e27.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x4E27 10696 bytes
SHA-256: 7292fe5224e62deef7387b73fd7ba8ac0fb0f93abe20bf9106ef4129193383f2

Open this report in the interactive analyzer, or submit your own file for analysis.