Malicious PDF — malware analysis report

Static analysis result for SHA-256 5e7240cdfbdcd086…

MALICIOUS

PDF

39.2 KB Authoring application: LibreOffice Draw
MD5: fcaa4aba92198a5507447c1812ae33da SHA-1: 4938b0977d5a00f253e91afa8fdcd8fa7dc7ddaf SHA-256: 5e7240cdfbdcd086ff0161f5453218fe9acbfa5dface5d47430b4b7fffb3e749
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of external links, many of which point to other PDF files, suggesting a link farm or redirection scheme. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document likely provides instructions to open a password-protected archive, a common tactic to evade initial security scanning. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://neflopioidepidemic.com/uploads/1/3/0/2/130288402/fawolaku.pdf
    • http://microhack.net/uploads/1/3/0/3/130313066/5019835.pdf
    • http://sonopadronedellamiavita.org/uploads/1/3/0/2/130289393/1944b11cd771e94.pdf
    • http://artandphotographyqld.com/uploads/1/3/0/5/130539820/134a54680c.pdf
    • http://b-erogazo.com/uploads/1/3/0/7/130738874/rekobuj-wipurobedezibuw.pdf
    • http://psychedaboutschool.com/uploads/1/3/0/6/130605307/7daf419087d6.pdf
    • http://gadgetgrump.com/uploads/1/3/0/5/130543087/zowiruza.pdf
    • http://carmelorganizer.com/uploads/1/3/0/5/130590561/banixexezob-zifekona-tedegedifutoz-povolizuzufex.pdf
    • http://eissachperformanceusaw.com/uploads/1/3/0/8/130874211/846863.pdf
    • http://cloudinno.net/uploads/1/3/0/6/130604111/04e559c.pdf
    • http://tradingpinhub.com/uploads/1/3/0/3/130323632/089935f30ba50.pdf
    • http://aqueenwithpurposeshop.com/uploads/1/3/0/8/130813818/3682812.pdf
    • http://pencilpenservices.com/uploads/1/3/0/9/130969492/130969492.html#como+subir+mi+autoestima+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003fe2.bin
73e78f125d97eb5594f55a49ea40d7479cb627bec936c13c267d6efe35b10f3b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3FE2 8988 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.