Malicious PDF — malware analysis report

Static analysis result for SHA-256 5fa028c8ba9bf2ec…

MALICIOUS

PDF

39.4 KB Authoring application: LibreOffice
MD5: 4ad5c2cbfc5beda451f6cf157c44a07c SHA-1: 71a032d0cff3223a677d4c7a49eb19a8bce681ff SHA-256: 5fa028c8ba9bf2ec9f6048173e901e9525d05dab123c17bacce26f26228c48dc
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document was flagged by ClamAV as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and exhibits a critical heuristic for containing a mass external PDF link farm. The embedded URLs likely lead to further malicious content or phishing sites. Although no scripts were explicitly extracted, the nature of the link farm suggests a distribution or redirection mechanism.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://servereserves.com/uploads/1/3/0/7/130774972/biwubotew.pdf
    • http://secreportingjobs.org/uploads/1/3/0/6/130639673/revun-wivaxexagovo-fevosojel.pdf
    • http://hykoo.net/uploads/1/3/0/3/130313271/6514942.pdf
    • http://www.aced.website/uploads/1/3/0/5/130588902/b4029.pdf
    • http://artani360.com/uploads/1/3/0/7/130775685/34c576621c.pdf
    • http://uberscrudu.com/uploads/1/3/0/7/130776529/5bc574c165e.pdf
    • http://denicheurprive.club/uploads/1/3/0/6/130640010/7772561.pdf
    • http://vcareheatingandplumbing.com/uploads/1/3/0/7/130739341/gitakesaxem_jorixikuduwi_gazapomin_regumedu.pdf
    • http://methodalliance.org/uploads/1/3/0/7/130739652/bipobupuzodelajupup.pdf
    • http://mrssnydersclass.com/uploads/1/3/0/4/130477036/wekawug.pdf
    • http://medicalmarijuanamenus.com/uploads/1/3/0/8/130814782/672203.pdf
    • http://praeducers.com/uploads/1/3/0/4/130435763/pogupokubedafururej.pdf
    • http://stadiacatering.com/uploads/1/3/0/7/130740164/vaxoxeroje.pdf
    • http://mistykwilliams.com/uploads/1/3/0/5/130550983/df55595510e0a.pdf
    • http://strategicallyasia.com/uploads/1/3/0/5/130550749/tesibodenapibitiro.pdf
    • http://nessasgoodiesshop.com/uploads/1/3/0/6/130620745/zadesorexixulofuwo.pdf
    • http://leprojetdememoire.com/uploads/1/3/0/8/130874592/ad1facd5.pdf
    • http://mendocinorose.com/uploads/1/3/0/5/130589452/232408.pdf
    • http://www.sussexbusinessdesigns.co.uk/uploads/1/3/0/2/130287445/bigovevazamu.pdf
    • http://cleanforetagsstad.com/uploads/1/3/0/8/130814343/wabum.pdf
    • http://comicbookdad.co/uploads/1/3/0/3/130379651/1848973.pdf
    • http://naonaprestige.com/uploads/1/3/0/6/130620651/a545c05810.pdf
    • http://millenialpages.com/uploads/1/3/0/7/130740008/telagi.pdf
    • http://jlcigars.com/uploads/1/3/0/6/130620228/wesiku_tixozax_wisetanew_tumodulaniv.pdf
    • http://that1wave.net/uploads/1/3/0/5/130543032/xaxizewomejixip-tekodanejugi.pdf
    • http://naturaltolife.com/uploads/1/3/0/2/130291707/130291707.html#sample+recommendation+letter+for+doctoral+student

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000036b3.bin
bd5c33927610735463877a7405cab08287586bbbbe50c589c0992982d6bff960		 pdf-font-stream PDF embedded font (sfnt) at offset 0x36B3 7600 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.