Malicious PDF — malware analysis report

Static analysis result for SHA-256 16cdad9405c200fe…

MALICIOUS

PDF

40.7 KB Authoring application: LibreOffice Draw
MD5: dbb3c94701268cea60ee25a1602c45d0 SHA-1: 11e4f45ab9ba41207c5726667e0b322bbad573eb SHA-256: 16cdad9405c200fe9bc4963a9503d88f9eda4265e3cd48ecc7064c16e0856604
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF document contains a large number of embedded external links, a technique commonly used in SEO poisoning or phishing campaigns to direct users to malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to distributing further malware or phishing pages. The primary attack pattern observed is the mass linking to other PDF files hosted on various domains.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nothingeasylifestyle.com/uploads/1/3/0/2/130271113/gibew-lobasuxobamos-misabotu-fakoz.pdf
    • http://link2yoo.net/uploads/1/3/0/6/130640088/8c1d6e5e83.pdf
    • http://stkyrelchoir.com/uploads/1/3/0/7/130739628/vuzutonidevota.pdf
    • http://akkijyrkka.com/uploads/1/3/0/4/130489361/b7a40783cd.pdf
    • http://yorkshiremotel.com/uploads/1/3/0/5/130589241/lurawaxojit.pdf
    • http://tcnj-barkada.weebly.com/uploads/1/3/0/6/130621802/julutuvaxejanisi.pdf
    • http://tradeinnovations.com/uploads/1/3/0/4/130490338/mijiwamopa-soxufukogorexe-wezut.pdf
    • http://crankworthymusic.com/uploads/1/3/0/4/130488583/9341155.pdf
    • http://dimo.gtwhitlow.com/uploads/2020/01/28/sirexibibejekun.pdf
    • http://chanabarriger.com/uploads/1/3/0/6/130640110/62734d3c354a.pdf
    • http://msb-art-integration.com/uploads/1/3/0/2/130289563/bometin.pdf
    • http://carbuzzznproductions.com.au/uploads/1/3/0/6/130639632/130639632.html#skype+offline+setup++for+windows+7

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000014d2.bin
543885db29a43fa619aca90a8c68b2d03d24f101004350e54f55d0cb48b8d36a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14D2 8816 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.