Malicious PDF — malware analysis report

Static analysis result for SHA-256 5ef8d6c6d1fb5b55…

MALICIOUS

PDF

51.7 KB Authoring application: LibreOffice
MD5: 864cb9531efd80621a32291d4b71ba17 SHA-1: c71618db3e72af6972c69577dfaf016f3f927486 SHA-256: 5ef8d6c6d1fb5b556289e5da6e1dca96b57ed887fb474bcfca28229ce8fdeb57
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, a technique often used for phishing or distributing further malware. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The embedded links likely serve as a link farm to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://necesitoarte.com/uploads/1/3/0/8/130874136/5b207f8b002c.pdf
    • http://cairnsretreats.com/uploads/1/3/0/5/130544131/jarixofa.pdf
    • http://orthopro.co.nz/uploads/1/3/0/6/130639703/441ea6d0be.pdf
    • http://angelaeischens.com/uploads/1/3/0/6/130620480/paxawide-zimaji.pdf
    • http://ndhaquascapes.com/uploads/1/3/0/8/130874067/pizogelutalimigonuni.pdf
    • http://hostmaster.naturallyfitter.com/uploads/1/3/0/6/130639906/7650015.pdf
    • http://belindawabelo.com/uploads/1/3/0/2/130272389/5e91d.pdf
    • http://parkeracresfarm.com/uploads/1/3/0/8/130813904/kukasixufe_kejupuv_pomovoriwalurul.pdf
    • http://lighthousefoodpantry.org/uploads/1/3/0/2/130289296/xerakevizenefi.pdf
    • http://www.homeeducationcreations.com/uploads/1/3/0/2/130272877/2b559e7f186f810.pdf
    • http://kristylewis.fish/uploads/1/3/0/5/130588531/mufaji.pdf
    • http://projectforereach.com/uploads/1/3/0/5/130540507/xovos.pdf
    • http://allwaystowingtx.com/uploads/1/3/0/6/130621048/tenixadojaseke.pdf
    • http://softwarehabits.org/uploads/1/3/0/2/130287428/nafoxesuf.pdf
    • http://starvedrockcountryresort.com/uploads/1/3/0/2/130289809/8142463.pdf
    • http://sneaksneakgame.com/uploads/1/3/0/5/130590164/f7c830f4eb8dd.pdf
    • http://laparunning.com/uploads/1/3/0/6/130604427/bd19d2.pdf
    • http://rlasfoundation.com/uploads/1/3/0/7/130776017/mapaf-denalof-sivezegeta.pdf
    • http://nom-vula.com/uploads/1/3/0/5/130540211/130664.pdf
    • http://ebnycelebration.com/uploads/1/3/0/4/130483086/4eb37e774d95f.pdf
    • http://metzmtaloysius.com/uploads/1/3/0/5/130551302/61caaaf.pdf
    • http://www.pjscoupons.com/uploads/1/3/0/2/130291492/vepafevorigoje_depis.pdf
    • http://www.wintersunproperties.com.au/uploads/1/3/0/3/130379204/kizezoloza_pomixufigixegal_lipepivasakega.pdf
    • http://mhrandlenovels.com/uploads/1/3/0/2/130270934/130270934.html#steelseries+arctis+7+bad+mic

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000014cf.bin
0b76fe9738626bb31c39530eccf5d92b97d93b344b9736eb2eabb53798bf86ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14CF 7652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.