Malicious PDF — malware analysis report

Static analysis result for SHA-256 15914cdcd1ac4603…

MALICIOUS

PDF

37.3 KB Authoring application: LibreOffice Draw
MD5: 8180ca73ee7dd7100dd838e60dd5ab89 SHA-1: 6316f05606c667841157c066ef83a9a4ccef3f29 SHA-256: 15914cdcd1ac46032cadd67aad5f271a181b2fe942865acc3e282294720733ea
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The document body, though heavily obfuscated, also contains several of these URLs. This suggests the primary purpose is to redirect users to potentially malicious content or for SEO manipulation. No scripts were extracted, but the presence of numerous external links points to a phishing or SEO spam attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://noblevisioncenter.net/uploads/1/3/0/8/130813866/vexusudozipaxuz.pdf
    • http://mentesconscientes.org/uploads/1/3/0/5/130539223/6fa06d112cac839.pdf
    • http://castroslandscapingma.com/uploads/1/3/0/6/130639173/f3ba132.pdf
    • http://brittany-paris.net/uploads/1/3/0/6/130620834/xemesafuz-dexita.pdf
    • http://dreamfarmeracademy.com/uploads/1/3/0/6/130620209/471131.pdf
    • http://plania.it/uploads/1/3/0/6/130605153/xigadozeforo.pdf
    • http://mjlpa.us/uploads/1/3/0/5/130589308/gaxawavew.pdf
    • http://kinesiscollective.com/uploads/1/3/0/6/130604720/siwepamupo_zimaxenuxim.pdf
    • http://drpatty.net/uploads/1/3/0/8/130874235/130874235.html#check+capacitor+polarity+multimeter
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001154.bin
58df4d96d02385dee182cadc39219bde3d7222026c39bb242d26ec8accf36599		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1154 7496 bytes
font_01_sfnt_off00005549.bin
1c2ff97ecfd79781e32b8e73148ac112eb5bbd615c5f296a34426ba9c46537e9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5549 2996 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.