Malicious PDF — malware analysis report

Static analysis result for SHA-256 13b0da8ab8aab507…

MALICIOUS

PDF

40.5 KB Authoring application: LibreOffice Draw
MD5: ad31987e88d0b3298d4d4ce26cdad835 SHA-1: 5b27e5ea3f77ab9a0042467d294192ba70d2c47b SHA-256: 13b0da8ab8aab5075dc2273009160111bfd8a8f5d70a3648ef3ceafe692dade2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or SEO spam campaign, designed to drive traffic to numerous sites. The ClamAV detection and ML classifier strongly suggest malicious intent, likely related to phishing or malware distribution through these linked documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pathaley.com/uploads/1/3/0/3/130379111/rejavewenukimoje.pdf
    • http://my-mindful-mind.com/uploads/1/3/0/6/130620670/7924044.pdf
    • http://www.katejutsum.org/uploads/1/3/0/5/130541662/tapazifukoporiwid.pdf
    • http://mc-mods.space/uploads/1/3/0/6/130603895/2541417.pdf
    • http://mysweatshops.com/uploads/1/3/0/7/130738771/zaluma_jevixodelolab.pdf
    • http://switchingtooboe.com/uploads/1/3/0/3/130324050/binogozekakur-geribotopakokuj.pdf
    • http://nsanegriplegendcarscom.com/uploads/1/3/0/6/130604948/fe14c3d08e.pdf
    • http://noveljourneyer.life/uploads/1/3/0/6/130620902/a77014affce31.pdf
    • http://mybloomyoga.com/uploads/1/3/0/6/130604313/5532607.pdf
    • http://recessdigital.com/uploads/1/3/0/8/130874317/1392673.pdf
    • http://erikajoye.com/uploads/1/3/0/5/130539249/nujufojeji.pdf
    • http://www.polarityzug.ch/uploads/1/3/0/6/130621947/130621947.html#3rd+conditional+speaking+activities
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f12.bin
1d1fa5121415f8f5353993473374918b9d2a38f433752094af4cce5d3be72c8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F12 16312 bytes
font_01_sfnt_off00004778.bin
9e852a2dfe81fa335fe6e2f81aaf5fbafd424a5c16e5e5729dca65ce01c3ebff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4778 7952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.