Malicious PDF — malware analysis report

Static analysis result for SHA-256 5188457b91529448…

MALICIOUS

PDF

39.2 KB Authoring application: LibreOffice Draw First seen: 2021-02-18
MD5: 3396e6b743979f050f1bf7ca5c788acb SHA-1: cc5c2f8ec35bf4463d41c3a41b07ea1223118b72 SHA-256: 5188457b91529448d6b37b5e859f1b346c3e6631dbeb28646a157cd39f63bb77
152 Risk Score

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://smarterdarter.com/uploads/1/3/0/4/130483479/5951867.pdf In PDF document text
    • http://xobexola.archisidek.com/uploads/2020/01/27/kalidepowuz.pdfIn PDF document text
    • http://missperryseducationstation.com/uploads/1/3/0/4/130483591/zosedefesugakon-daxire-tobusenit-vimexewumebadib.pdfIn PDF document text
    • http://30grayin10.com/uploads/1/3/0/6/130604129/fijidat.pdfIn PDF document text
    • http://adkvision.org/uploads/1/3/0/4/130436137/nizetovujage_kabomazokadaka.pdfIn PDF document text
    • http://banjolele.net/uploads/1/3/0/4/130476816/toxatokabavuta.pdfIn PDF document text
    • http://arrow-health.com/uploads/1/3/0/5/130546977/c2bcacb8eab62.pdfIn PDF document text
    • http://miriamgracepayne.com/uploads/1/3/0/5/130543272/zazam_mobir.pdfIn PDF document text
    • http://keg.black-port.ru/uploads/2020/01/28/98b91b.pdfIn PDF document text
    • http://msjohnsons4thgrade.weebly.com/uploads/1/3/0/5/130541140/5072287.pdfIn PDF document text
    • http://judaxunus.promobile.tech/uploads/2020/01/28/4914510.pdfIn PDF document text
    • http://kujos.kuhnimsc09.icu/uploads/2020/01/29/6497084.pdfIn PDF document text
    • https://piwetusidazu.weebly.com/uploads/1/3/0/5/130551364/8644578.pdfIn PDF document text
    • http://bearfruitsbaskets.com/uploads/1/3/0/4/130436473/9e358077.pdfIn PDF document text
    • http://foli.3destate.ru/uploads/2020/01/27/8814586.pdfIn PDF document text
    • http://chrisarkwright.com/uploads/1/3/0/3/130323445/5416627.pdfIn PDF document text
    • http://schmittwoodworkingllc.com/uploads/1/3/0/2/130271090/130271090.html#orthographe+illustr%C3%A9e+pdfIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000014d0.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x14D0 9560 bytes
SHA-256: 240d7134fe6730fc5fcc5c9f21cbdf9d5d6e0d2a984758f05b79ad25a4e4ef3a

Open this report in the interactive analyzer, or submit your own file for analysis.