Malicious PDF — malware analysis report

Static analysis result for SHA-256 52f99b81fb50b83e…

MALICIOUS

PDF

40.1 KB Authoring application: LibreOffice
MD5: e6c35618340386707c38bf0feeb5713e SHA-1: a6079e8cb23acafa210020f747ab6f05d987a406 SHA-256: 52f99b81fb50b83e1b1174e0fbd279994e095e10cd1577b3dfed858c81130f7f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of embedded links to external PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a tactic to distribute malicious content or phish users by overwhelming them with links. The ML classifier and ClamAV detection further support its malicious nature, flagging it as phishing-related malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cuskga.com/uploads/1/3/0/4/130488955/reluromenel.pdf
    • http://talesfromsixthgrade.com/uploads/1/3/0/3/130323425/lijubojotinivaj.pdf
    • http://xeke.vipiski-besplatno64.icu/uploads/2020/01/28/kobinojus_dodibunumepo.pdf
    • http://brokenhartarena.org/uploads/1/3/0/6/130604340/1e5d61c14c3341a.pdf
    • http://lindsayplouffe.com/uploads/1/3/0/2/130289696/ffeeb.pdf
    • http://stephenm.ca/uploads/1/3/0/2/130289186/6069792.pdf
    • http://sima-se-design.com/uploads/1/3/0/6/130620819/0798f08d.pdf
    • http://predatorhelmet.ru/uploads/2020/01/27/83e5e74a2b.pdf
    • http://jim.pp-offer.xyz/uploads/2020/01/28/dabojirotorax_pegowuguk.pdf
    • http://tomorrowlogy.com/uploads/1/3/0/7/130775166/7540485.pdf
    • http://gocustomstamps.com/uploads/1/3/0/4/130483872/1181006.pdf
    • http://niyahj.com/uploads/1/3/0/6/130603896/zemajib_vazusavujotip_mibatotunumi_gulomiko.pdf
    • http://theelfbox.com/uploads/1/3/0/6/130620936/130620936.html#hernia+ventral+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000133a.bin
b0c521f16a1d0de2a727c5b0171cfcaf63a4b3fd7268b43cffc97c1bac905509		 pdf-font-stream PDF embedded font (sfnt) at offset 0x133A 8900 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.