Malicious PDF — malware analysis report

Static analysis result for SHA-256 63a2469479803e25…

MALICIOUS

PDF

46.9 KB Authoring application: LibreOffice
MD5: 160cb8cef0f6251f7b895f5179c9acd9 SHA-1: 2afff6cbb82700892a04a05740f250bb8677cd9f SHA-256: 63a2469479803e25c88b64a406e715ead6fbf682fe8a17603dbce444c0ba7684
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a malicious intent to manipulate search engine results or redirect users to potentially harmful websites. The ML classifier and ClamAV detection further support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://marinautomotive.com/uploads/1/3/0/8/130813592/431065.pdf
    • http://lolling.design/uploads/1/3/0/2/130288317/batogezi.pdf
    • http://vixentattoo.com/uploads/1/3/0/5/130545636/5807486.pdf
    • http://webdisk.raumanratsastuskeskus.net/uploads/1/3/0/6/130640052/9212796.pdf
    • http://twentiesandconfused.com/uploads/1/3/0/8/130814088/5207e984f3eb9.pdf
    • http://lilyfairjewellry.com/uploads/1/3/0/7/130739173/xejogido-sigefagivof-motimuv-pusix.pdf
    • http://alinmobiliaria.com/uploads/1/3/0/6/130621447/lefukar_sodugo.pdf
    • http://cfcgrp.com/uploads/1/3/0/4/130491752/wenew.pdf
    • http://www.relaxingwell.com/uploads/1/3/0/5/130540583/3480406.pdf
    • http://minibaraddict.com/uploads/1/3/0/7/130739192/moxuzatidam_lexupe.pdf
    • http://www.miggyscott.co.uk/uploads/1/3/0/6/130620295/6249552.pdf
    • http://woodpeckerpole.com/uploads/1/3/0/5/130539105/6bec2800799e927.pdf
    • http://creativechecklist.com/uploads/1/3/0/8/130814462/1dbcf6b9bb9c5e5.pdf
    • http://carsonmugs.com/uploads/1/3/0/6/130620943/futagipabixo.pdf
    • http://sandyspringspestpros.com/uploads/1/3/0/5/130589103/4ee303c0c.pdf
    • http://glashandellaren.com/uploads/1/3/0/6/130621530/5ec9da.pdf
    • http://errqre.com/uploads/1/3/0/6/130621503/1677375.pdf
    • http://adsl-65-43-110-210.carmichaelnl.com/uploads/1/3/0/6/130621444/130621444.html#abbyy+finereader+14+user+manual

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005887.bin
e302a3791bfe17d0e273611875f77d87ae750ea5ed2a87712c25b4ff601c4af9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5887 9672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.