Malicious PDF — malware analysis report

Static analysis result for SHA-256 f802c24cfdb2621b…

MALICIOUS

PDF

40.5 KB Authoring application: OpenOffice Draw
MD5: 2ba00e811de727e34234fb9ba158ef5b SHA-1: d8215cd32f348e0eed124f74d0fc748b43155b89 SHA-256: f802c24cfdb2621b2aa277ebe1cf5afa8425ff661e566abe995b0acec5b69fb5
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also flag this file as malicious. The document body, though partially corrupted, mentions arguments against globalization, suggesting a potential lure or distraction. The primary attack pattern involves directing users to numerous external PDF files hosted on various domains.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://noahsanchorarmy.com/uploads/1/3/0/7/130775531/nunezevajimugon.pdf
    • http://mail.everyday-wines.com/uploads/1/3/0/6/130639365/dc376b11946691f.pdf
    • http://part-timecfo.net/uploads/1/3/0/3/130313391/zokikexedezelan-fukononomotiti.pdf
    • http://remoteremoval.com/uploads/1/3/0/6/130621950/gasinuvokapeg.pdf
    • http://courtneysnyderart.com/uploads/1/3/0/7/130776211/suwusowawubasu-narivid-dopimosef-vipefozimazimav.pdf
    • http://nwcbuildingservices.com/uploads/1/3/0/3/130324350/6622184.pdf
    • http://robinsonbasketball.com/uploads/1/3/0/6/130605152/rinikipomem-veluvi-siwulexazodivaj.pdf
    • http://refugeespeaker.org/uploads/1/3/0/4/130488741/nibakurupib_geragafedikaku_wadepezufuregi_lamibupoxokugek.pdf
    • http://paulmurrayphoto.com/uploads/1/3/0/2/130289652/pojoxodefatozelidalu.pdf
    • http://thephillycomic.com/uploads/1/3/0/7/130776322/7139471.pdf
    • http://christiansofprinceton.org/uploads/1/3/0/5/130588394/338b65032af195.pdf
    • http://08dushu.com/uploads/1/3/0/2/130289406/kalinijerosuj-govuk-jilipazire.pdf
    • http://www.servilogin.com/uploads/1/3/0/5/130542940/2700331.pdf
    • http://elitesip.com/uploads/1/3/0/4/130488244/1b824f1eea.pdf
    • http://www.greenbrainenergy.ca/uploads/1/3/0/3/130379675/639dc34a900.pdf
    • http://mesmeranddeleault.com/uploads/1/3/0/2/130288864/fikagixilebajalasok.pdf
    • http://www.allisonlucchetti.com/uploads/1/3/0/7/130739253/eb44f14e78.pdf
    • http://www.triciajoyart.com/uploads/1/3/0/7/130775056/62b1ddafc.pdf
    • http://oliverapps.net/uploads/1/3/0/3/130313428/1642290.pdf
    • http://4n0.com/uploads/1/3/0/6/130639634/nugepawiwoden.pdf
    • http://www.allanenv.com/uploads/1/3/0/6/130604388/c83e2c99.pdf
    • http://host161.carmichaelnl.com/uploads/1/3/0/5/130588934/130588934.html#make+three+examples+of+reactions+against+globalism+and+globalization

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003e44.bin
e9bc1be746ae1264ae2b12486785bb571059196cfca7b57b790e9bd70b2866f8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3E44 7652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.