Malicious PDF — malware analysis report

Static analysis result for SHA-256 12a8577f32cc96b9…

MALICIOUS

PDF

58.7 KB Authoring application: LibreOffice Draw
MD5: 5290f546ae4fe40138108b63bde671ed SHA-1: 80db7185274f3f600e3e64ccbd9a83ac110837ff SHA-256: 12a8577f32cc96b9ff4cca4758654b07052ec91f3fb64e6f3bc3dec8eb1aeb9a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded URLs pointing to other PDF documents hosted on various websites. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic and ClamAV detection. The embedded URLs are likely intended to redirect users to potentially harmful sites or to manipulate search engine results.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mgp-audio.weebly.com/uploads/1/3/0/6/130604595/93d0ace91734eb4.pdf
    • https://judapegiwet.weebly.com/uploads/1/3/0/4/130478709/9910033.pdf
    • http://nicolas-rigaux-photographe.com/uploads/1/3/0/6/130604495/6573023.pdf
    • http://casachurba.com/uploads/1/3/0/4/130476075/bomelajeferodexava.pdf
    • https://rufawilezu.weebly.com/uploads/1/3/0/3/130313755/8684701.pdf
    • http://bozolu.svyazexpo-online.ru/uploads/2020/01/29/jozodubalofuziz_zitexaw_boxakiw.pdf
    • http://cosmixmovies.com/uploads/2020/01/28/xukikudekibadudoge.pdf
    • http://pnowebgap.com/uploads/1/3/0/5/130538950/zesoritexi_roraduli_mosupawedis.pdf
    • http://hausparzival.org/uploads/1/3/0/6/130620519/1794157.pdf
    • http://jessicagaul.com/uploads/1/3/0/4/130476691/5ed9db177d25.pdf
    • http://wrmsamiller.weebly.com/uploads/1/3/0/6/130604321/8857575.pdf
    • http://nestnewhomes.com/uploads/1/3/0/2/130272856/pimufekaxe.pdf
    • http://rockyridgeacres.org/uploads/1/3/0/4/130489072/674681.pdf
    • http://slgmediagroup.com/uploads/1/3/0/6/130604288/572fbf256a.pdf
    • https://rosefudob.weebly.com/uploads/1/3/0/4/130483508/2a13f.pdf
    • http://adriftwoodworks.com/uploads/1/3/0/5/130542822/5438308.pdf
    • http://nabeelreviews.com/uploads/1/3/0/4/130488700/3662288.pdf
    • https://tagulole.weebly.com/uploads/1/3/0/2/130271165/852407.pdf
    • http://nmis.co/uploads/1/3/0/5/130539756/bajudade-rinurufegix.pdf
    • http://kreativekidsworld.com/uploads/1/3/0/3/130313054/130313054.html#android+notificationcompat.+builder+sound

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001622.bin
4aea10ca090244a6f512547a752d039c299768367e0e7c56ba4115c3403e7a95		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1622 8600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.