Malicious PDF — malware analysis report

Static analysis result for SHA-256 15d9219cc7b3363e…

MALICIOUS

PDF

42.8 KB Authoring application: LibreOffice
MD5: 33fc25ac47d18621c51272ab74f00290 SHA-1: cc3d3698baa2d1bc3c2cbbe66bafa6b58cbe1db5 SHA-256: 15d9219cc7b3363e9b3a2fb708847e94c93c04634fff11c0513dc2e730ff40bc
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, identified as a link farm, which is a common technique for SEO manipulation or distributing malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution. Although no scripts were explicitly extracted, the PDF structure and embedded URLs suggest an attempt to redirect the user to potentially harmful external resources.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://kiloxozijewova.weebly.com/uploads/1/3/0/3/130312929/rinirexipufuda_togoluwafojuvix.pdf
    • http://gidolunat.1medvrn.ru/uploads/2020/01/28/jiwijaba.pdf
    • https://voxosajizeta.weebly.com/uploads/1/3/0/5/130546434/83363b071a4bc.pdf
    • http://timejulora.belvit.by/uploads/2020/01/28/lozuja.pdf
    • http://anxiouslittlepishy.com/uploads/1/3/0/2/130272505/lidumupoxijewoner.pdf
    • http://keepcalmwaxon.com/uploads/1/3/0/5/130540461/jobabudigoropix-wevok-pegeb.pdf
    • http://castsensors.com/uploads/2020/01/28/fe34b.pdf
    • http://notrioforcats.weebly.com/uploads/1/3/0/4/130483110/mufawenapikazuz_vuruvidofeda_sozoburaxe.pdf
    • https://pokizizefavef.weebly.com/uploads/1/3/0/5/130588477/fobetepo_xamugo_tedug.pdf
    • http://772holly.com/uploads/1/3/0/2/130272880/9f695b8d82e038.pdf
    • https://xubasirit.weebly.com/uploads/1/3/0/6/130605010/8310803.pdf
    • http://mevat.laama.ru/uploads/2020/01/27/wumijegavexijupoz.pdf
    • http://morewirehouseandanimal.com/uploads/1/3/0/5/130543377/bosanerezum.pdf
    • http://renenkay.com/uploads/1/3/0/5/130543575/zukiz.pdf
    • http://pob.gruzodelov.ru/uploads/2020/01/28/4addfec451.pdf
    • https://benopivezoso.weebly.com/uploads/1/3/0/2/130270845/guketaji_sitaturew_simolimi.pdf
    • http://yaremkospt.com/uploads/1/3/0/2/130271150/buzalatenovolemafe.pdf
    • http://blythetierneydever.com/uploads/1/3/0/6/130639313/niwonegazubom-nugedexenubiw-wixabufilimu-bonipukafo.pdf
    • http://laughingduck.org/uploads/1/3/0/6/130604270/9da9a2.pdf
    • http://sauerlandhypotheek.nl/uploads/1/3/0/5/130550980/130550980.html#speech+writing+format+for+class+9th

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016ad.bin
a0c428865f0a6ecf9d56a4033f24f3b1fc668f499d5137bdf6852bfdb31cdd0b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16AD 9564 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.