Malicious PDF — malware analysis report

Static analysis result for SHA-256 fe8d3fbf0b3b524e…

MALICIOUS

PDF

82.8 KB Authoring application: OpenOffice Draw First seen: 2020-09-24
MD5: 398166fcf46d0b143df86300e8b9a52d SHA-1: 75fae4984c6831af708e3f1102c812ce1b4a7609 SHA-256: fe8d3fbf0b3b524e133c9533a6b7c2f8dd1c3893c65b100939f069e88ab50d11
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF documents, indicating it functions as a link farm. This is strongly suggested by the 'PDF_SEO_LINK_FARM' heuristic firing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9723

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://daycareplayground.com/uploads/1/3/0/7/130776260/temoguk-morekapi-vesizuwi.pdf In PDF document text
    • http://robinjoyphotography.net/uploads/1/3/0/5/130589245/jojexuvex_pegisebif.pdfIn PDF document text
    • http://drallison.com/uploads/1/3/0/5/130588654/8c4255.pdfIn PDF document text
    • http://asphaltisland.com/uploads/1/3/0/2/130289236/2927642.pdfIn PDF document text
    • http://fruitymessagebroker.net/uploads/1/3/0/7/130738821/eec8f16.pdfIn PDF document text
    • http://mikaimtrading.co.za/uploads/1/3/0/6/130620672/mowutunapo.pdfIn PDF document text
    • http://bevilacquaguitars.com/uploads/1/3/0/2/130291575/6f5a4.pdfIn PDF document text
    • http://laventanadecali.com/uploads/1/3/0/4/130435783/didorenexoxi.pdfIn PDF document text
    • http://cyclebavaria.com/uploads/1/3/0/2/130289645/4cc14b31.pdfIn PDF document text
    • http://apietrantoni.com/uploads/1/3/0/4/130490117/2c9121e63ef3468.pdfIn PDF document text
    • http://novamedia.dk/uploads/1/3/0/7/130775197/2422901.pdfIn PDF document text
    • http://salftom.store/uploads/1/3/0/7/130740537/8587882.pdfIn PDF document text
    • http://canausvisa.ca/uploads/1/3/0/2/130287463/dosokot.pdfIn PDF document text
    • http://trishasxtremeclean.net/uploads/1/3/0/2/130289625/tusabibize-lajotatit.pdfIn PDF document text
    • http://rxalens.net/uploads/1/3/0/4/130436288/2744196.pdfIn PDF document text
    • http://opforarmory.com/uploads/1/3/0/2/130289645/surudilanapika-minexo-tikedusa-velajalobamazip.pdfIn PDF document text
    • http://lauralemay.net/uploads/1/3/0/7/130776745/4866510.pdfIn PDF document text
    • http://www.study-to-success.com/uploads/1/3/0/5/130590356/ae076a88e73.pdfIn PDF document text
    • http://cockblockproductions.com/uploads/1/3/0/6/130604340/nanujig.pdfIn PDF document text
    • http://archlegacy.com/uploads/1/3/0/7/130740117/9944380.pdfIn PDF document text
    • http://nastymattress.com/uploads/1/3/0/5/130539928/3542695.pdfIn PDF document text
    • http://attiliosfarms.com/uploads/1/3/0/5/130543877/1456885.pdfIn PDF document text
    • http://cams-collection.com/uploads/1/3/0/6/130621583/c500d14.pdfIn PDF document text
    • http://jimturrell.net/uploads/1/3/0/7/130739309/jagedagunokemab-nawariw.pdfIn PDF document text
    • http://zapchasti-online.space/uploads/1/3/0/2/130291572/b60ae16f96f8.pdfIn PDF document text
    • http://quanxunwangbeiyongwangzhi.br3h.com/uploads/1/3/0/7/130738513/130738513.html#lactic+acidosis+meaning+in+tamilIn PDF document text
    • http://www.ascendercorp.com/In PDF document text
    • http://www.ascendercorp.com/typedesigners.htmlIn PDF document text
    • http://linux.thai.net/projects/fonts-tlwgIn PDF document text
    • http://www.thaitux.infoIn PDF document text
    • http://dejavu.sourceforge.netIn PDF document text
    • http://dejavu.sourceforge.net/wiki/index.php/LicenseIn PDF document text
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicenseIn PDF document text
    • https://savannah.gnu.org/projects/freefont/In PDF document text
    • http://www.gnu.org/licenses/In PDF document text
    • http://www.gnu.org/copyleft/gpl.htmlIn PDF document text
    • http://www.adobe.com/).NotoIn PDF document text
    • http://www.google.com/get/noto/http://www.adobe.com/type/ThisIn PDF document text
    • http://scripts.sil.org/OFLNotoIn PDF document text

Related samples 8

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 7

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00008ce0.bin decompressed-pdf-stream PDF FlateDecoded stream at offset 0x8CE0 19308 bytes
SHA-256: 1e7f193219d252bff7b131d265a249595c1ec3ea33720dd30cb827603748dbae
font_00_sfnt_off0000579e.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x579E 3724 bytes
SHA-256: f5876bb0eda21d4c0e3becbdc404d1e4a14d89811f09b8f2aec1e019ec9e44f0
font_01_sfnt_off000063f5.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x63F5 10240 bytes
SHA-256: bbd465158f88620f6b89bbc14fd4053a393fda34b464cf5d9625b9580ee6f51f
font_02_sfnt_off00007975.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x7975 7316 bytes
SHA-256: b1118302c5517eb61a6a239cbb0c0398f36a596cc95e76ebefef7294164c1510
font_04_sfnt_off0000abec.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xABEC 6908 bytes
SHA-256: 03742b3af56d0894ab5df65dc3134d6d1f1537ecfbbc759efc3d5c9763d8381a
font_05_sfnt_off0000c206.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xC206 8116 bytes
SHA-256: 25210ba12aeb24b23a7f408187dfb784faa727fd123f685f3f2ae776772c54fe
font_06_sfnt_off0000db62.bin pdf-font-stream PDF embedded font (sfnt) at offset 0xDB62 11616 bytes
SHA-256: 3cef15fba8532ec0fd13f10d769cd930b7f4396e13ded5366012fab342fad235

Open this report in the interactive analyzer, or submit your own file for analysis.