Malicious PDF — malware analysis report

Static analysis result for SHA-256 5eccec9cb9fcf33e…

MALICIOUS

PDF

37.5 KB Authoring application: LibreOffice
MD5: b8e74f4bf278cb6888348d17c4484691 SHA-1: 1c3d0daf15866b0c30aa7f9b38eef0c93308e744 SHA-256: 5eccec9cb9fcf33e40a9ce3afdabc3665dc5cf58ecbd6096c028ce6c64fe7925
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains numerous links to external PDF files hosted on a variety of domains, a technique often used for phishing or distributing further malware. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies this pattern of mass external PDF linking. The ClamAV detection and ML classifier also strongly indicate malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://reclaimyourhealth.info/uploads/1/3/0/5/130588268/43c508a5.pdf
    • http://musicforprospectheights.com/uploads/1/3/0/3/130379488/8d3e9.pdf
    • http://chaseinsulinbox.com/uploads/1/3/0/5/130539316/robenejovosaz.pdf
    • http://annethielen.nl/uploads/1/3/0/5/130589146/1f9d310287.pdf
    • http://agapeeducationalconsultantsandtrainers.org/uploads/1/3/0/3/130323425/b1f011878bda.pdf
    • http://rotateproxy.com/uploads/1/3/0/5/130588724/2507322.pdf
    • http://apsolutionsllc.net/uploads/1/3/0/6/130620778/a3ea175064e.pdf
    • http://pax.knvanna.ru/uploads/2020/01/28/9518389.pdf
    • http://michaudwellness.com/uploads/1/3/0/7/130775123/130775123.html#mujeres+abotonadas+con+perros

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001164.bin
200e55a5a5d7af28b05a54c6ace793220f24a1a0b4e68a1cda4d1f98b28e2fd7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1164 8180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.