Malicious PDF — malware analysis report

Static analysis result for SHA-256 205d4f8b6007ea7b…

MALICIOUS

PDF

45.2 KB Authoring application: LibreOffice Draw
MD5: 2910833f764bda1b9029c4abd4cf1c07 SHA-1: 661c39541a79a3a8598882af311159859525706d SHA-256: 205d4f8b6007ea7b952772bd4b4c9e85b3c5bc19d068eb6654e15f96ac1a7f08
152 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, a technique often used for SEO manipulation or to distribute further malware. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs suggest a phishing or content distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://studentsmentalhealth.net/uploads/1/3/0/5/130550731/delaxofutiw_gonesas.pdf
    • http://www.sunshineplace.com/uploads/1/3/0/9/130969045/637285350f68ba.pdf
    • http://www.strategies4busyteachers.com/uploads/1/3/0/6/130621026/8639437.pdf
    • http://fruithousebakery.com/uploads/1/3/0/5/130588867/c0e72248287ee2.pdf
    • http://texasplanetsub.com/uploads/1/3/0/4/130436172/zebenowor.pdf
    • http://metrophoenixhypnotherapy.com/uploads/1/3/0/8/130814584/ruripetobusitigi.pdf
    • http://katletki.com/uploads/1/3/0/3/130323493/5503238.pdf
    • http://mishevski.de/uploads/1/3/0/2/130289782/zajasivemipelora.pdf
    • http://troymichiganhotels.com/uploads/1/3/0/2/130274166/74ecf492c.pdf
    • http://lifewanker.com/uploads/1/3/0/6/130621111/4774562.pdf
    • http://www.ozgurince.co/uploads/1/3/0/5/130545480/palebinase.pdf
    • http://newcityvintage.com/uploads/1/3/0/5/130589411/gogobosedobevidodi.pdf
    • http://nom-vula.com/uploads/1/3/0/8/130873856/3303187.pdf
    • http://spicesonlinebe.com/uploads/1/3/0/2/130272918/gikakadukunute_kuvezakerop.pdf
    • http://drewwatsonpups.com/uploads/1/3/0/5/130552055/wojir_xewifobegi.pdf
    • http://woundedwarriorwife.com/uploads/1/3/0/4/130476066/mamalaxabar_mufirawiseto_pasawepikivakuk.pdf
    • http://mollymagdalain.com/uploads/1/3/0/3/130379183/d96681ccf163.pdf
    • http://hostmaster.feingefuehl.ch/uploads/1/3/0/5/130590278/viguxopabimuwesobal.pdf
    • http://nomadiccollege.com/uploads/1/3/0/4/130435619/fowupupo.pdf
    • http://tng2010.com/uploads/1/3/0/6/130639746/e6761a404b6.pdf
    • http://traveleverywherewithellisa.voyagerwebsites.com/uploads/1/3/0/6/130621226/130621226.html#7+continents+and+5+oceans+of+the+world+map

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004ff5.bin
12ad33cd1205252d24d6397170665366d27c9336085cee24f1f7270f51b4dd01		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4FF5 8728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.