Malicious PDF — malware analysis report

Static analysis result for SHA-256 ff05dbf656ae62e2…

MALICIOUS

PDF

69.0 KB Authoring application: OpenOffice Draw First seen: 2021-09-23
MD5: 819b645c9aee26ebae4aa92b068790f7 SHA-1: 193cb4d1085bdff29d06954d2dfaca5d51cd5ad3 SHA-256: ff05dbf656ae62e2232a623ae3480a448a74b8fb93a62c5c4fe00cb7c2c6e1d1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF document was flagged as malicious by ClamAV and an ML classifier. The file embeds a large number of external links characteristic of an SEO link farm. Specific URLs and indicators for this sample are listed in the indicators section.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://themoviefangirl.com/uploads/1/3/0/5/130551991/xifimibinik.pdf In PDF document text
    • http://malaga.centroseq.com/uploads/1/3/0/6/130620709/pifigixewa-sibetofisi-gumaz-guwutemunutifeb.pdfIn PDF document text
    • http://www.milkandhoney.care/uploads/1/3/0/5/130544387/sarema-noxegodupali-dotoxavugid-lirotaz.pdfIn PDF document text
    • http://showtimerecords.co.za/uploads/1/3/0/4/130488228/forojewijepusobil.pdfIn PDF document text
    • http://www.nylamikaelsonsstory.com/uploads/1/3/0/6/130620327/jatusetumu.pdfIn PDF document text
    • http://captraining12.com/uploads/1/3/0/7/130776409/gomidorolalarigag.pdfIn PDF document text
    • http://www.langoloristorante.com/uploads/1/3/0/6/130639860/wuwolugip.pdfIn PDF document text
    • http://beetreebonebroth.com/uploads/1/3/0/3/130313524/7645849.pdfIn PDF document text
    • http://pamswaycreations.com/uploads/1/3/0/5/130538866/9670779.pdfIn PDF document text
    • http://www.modernessencestore.com/uploads/1/3/0/6/130620731/3923430.pdfIn PDF document text
    • http://blessedmoondoula.com/uploads/1/3/0/7/130776295/fadafomupenikixev.pdfIn PDF document text
    • http://jbswearwholesale.com/uploads/1/3/0/5/130588426/xajevagizuvoru_naxubomomigo.pdfIn PDF document text
    • http://scug.org/uploads/1/3/0/8/130874329/kifog-mimawapelij-bufobi-mopemobum.pdfIn PDF document text
    • http://nintaipartners.com/uploads/1/3/0/6/130639767/bitaboliborubu-nunefatewoda-temosodis-munorugunanaxit.pdfIn PDF document text
    • http://rickformi.net/uploads/1/3/0/7/130775979/rinas_jiduvu_befeve.pdfIn PDF document text
    • http://tierisch-tragbar.de/uploads/1/3/0/5/130551324/kejujevebuga.pdfIn PDF document text
    • http://niedbrass.com/uploads/1/3/0/7/130739140/kafulufizigafiw_muzeweju_jugufuromuna_sagolupudixor.pdfIn PDF document text
    • http://alaskafoodie.info/uploads/1/3/0/5/130539599/seputavibabejul.pdfIn PDF document text
    • http://defragrancehouse.com/uploads/1/3/0/8/130814516/a71052.pdfIn PDF document text
    • http://remote.carrollprinting.com/uploads/1/3/0/6/130605259/7372f5ea4.pdfIn PDF document text
    • http://ga65q.slpny.com/uploads/1/3/0/6/130621988/jizerofovatojojesu.pdfIn PDF document text
    • http://studyinfo.ch/uploads/1/3/0/5/130543369/sabidetamuwado.pdfIn PDF document text
    • http://mail.earlgreen.net/uploads/1/3/0/8/130814339/a223f.pdfIn PDF document text
    • http://webdisk.evylareau.com/uploads/1/3/0/7/130776409/130776409.html#prefixes+and+suffixes+chartIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001ab4.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x1AB4 7536 bytes
SHA-256: 39c4188eecf10d20b696322858a1b4e7a3cce2ac5c813d18c8686ca6de952b5c

Open this report in the interactive analyzer, or submit your own file for analysis.