Malicious PDF — malware analysis report

Static analysis result for SHA-256 010108914d6b0e70…

MALICIOUS

PDF

46.2 KB Authoring application: LibreOffice
MD5: a69fb3cbc55a1e5a63157e6d58bacd44 SHA-1: 8c817c170fb2737b2c238c216ce3d33335efd466 SHA-256: 010108914d6b0e70f5d85a0b5c30bb8faf607d8317049c29eb02c9d2402f24ac
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a link farm or distribution mechanism. The ML classifier and ClamAV detection strongly indicate malicious intent, likely related to phishing or malware distribution through these linked resources.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://legacytaxidermy.net/uploads/1/3/0/4/130435710/zeviro.pdf
    • http://newearthwarrior.org/uploads/1/3/0/5/130588334/5f385871712a518.pdf
    • http://mirabellchicago.com/uploads/1/3/0/6/130620197/pimosewujav.pdf
    • https://dikilabeneda.weebly.com/uploads/1/3/0/5/130541743/36ab808a7f9.pdf
    • http://cranfordfishstand.com/uploads/1/3/0/2/130271214/ruribijijuju_golegozakuwewe.pdf
    • http://miiasoey.com/uploads/1/3/0/2/130289441/nodage.pdf
    • http://cocominksstore.com/uploads/1/3/0/5/130588987/xawenigiza.pdf
    • http://sezu.lesfondsdequilles.com/uploads/2020/01/28/7786891.pdf
    • http://fonestalve.com/uploads/1/3/0/5/130588778/3066f2398162a.pdf
    • http://101taiwantour.com/uploads/1/3/0/2/130274378/6574975.pdf
    • http://tedibuz.shapewear-official.pro/uploads/2020/01/28/dagomove_gupiku_kofupomenaxut_virezolimej.pdf
    • http://mindforyou.org/uploads/1/3/0/7/130739185/130739185.html#iphone+scanner+app+to+pdf
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000138e.bin
9d03d08d2100546eae755845fcb7016ab53909b0085df377ad71a874e4a072c5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x138E 10176 bytes
font_01_sfnt_off000068e4.bin
8f159a6b454c8d4c979d21f480e67f5fe0c589c5f3781b969e8b69368f18fae7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x68E4 19424 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.