Malicious PDF — malware analysis report

Static analysis result for SHA-256 63ca2cc1a830b0ca…

MALICIOUS

PDF

42.1 KB Authoring application: LibreOffice
MD5: fbcf0d751dd2f7ee61290bd21f6620d0 SHA-1: d63f6b4ef80afaab31e14d14675f202594954704 SHA-256: 63ca2cc1a830b0caeaf202dcac05d6fdc0e8dc3814e11725587491de2e93b5fd
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. It contains a large number of embedded external PDF links, suggesting a link farm or redirection mechanism. The document body contains garbled text and mentions 'Yourkit profiler download', which appears to be a lure.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fortnitebuddy.com/uploads/1/3/0/7/130739223/tikedup_zoreruzisisete_finafojijigeli.pdf
    • http://mriservicesnj.com/uploads/1/3/0/3/130324451/sosetukosa.pdf
    • http://southperthbaptist.org/uploads/1/3/0/5/130550961/padirowawem-xobukep-juzapilet.pdf
    • http://sectormental.net/uploads/1/3/0/6/130639548/jeduvalulurake_puzojamabo_devubane_zudatamukege.pdf
    • http://www.mutiara-meu.com/uploads/1/3/0/4/130491703/dagarojadisipo.pdf
    • http://annearundelbiz.com/uploads/1/3/0/5/130538990/litokut_zufuli_zaxemowasofepi.pdf
    • http://www.argcircuitseries.com/uploads/1/3/0/6/130621000/2929165.pdf
    • http://williampfrench.com/uploads/1/3/0/7/130775511/gosazinizuv.pdf
    • http://www.taduforyou.de/uploads/1/3/0/3/130313445/0101ff1f0.pdf
    • http://sqonecondos.com/uploads/1/3/0/8/130873869/76a022fe5c.pdf
    • http://ioamovement.com/uploads/1/3/0/4/130476624/4077058.pdf
    • http://define-living.com/uploads/1/3/0/6/130622104/loxevijabunope.pdf
    • http://socialvidcon.com/uploads/1/3/0/6/130639307/7425937.pdf
    • http://nowbiz.net/uploads/1/3/0/7/130776886/d9468.pdf
    • http://spectruma.co.uk/uploads/1/3/0/4/130483540/c7599b97fb2f.pdf
    • http://annasparklebox.com/uploads/1/3/0/5/130590741/7437450.pdf
    • http://ghdobermann.es/uploads/1/3/0/5/130541574/3517246.pdf
    • http://northernvalleysportinggoods.com/uploads/1/3/0/5/130551962/luvafizogebu.pdf
    • http://theoverhumans.com/uploads/1/3/0/5/130588494/03ee0022f84f90.pdf
    • http://sequoia77.pleasingfood.com/uploads/1/3/0/6/130604375/130604375.html#yourkit+profiler+download
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002eb2.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2EB2 16036 bytes
font_01_sfnt_off000045c1.bin
d2c6af7739717126c4d25f78fdf5dd9ba1d1427dac2b3ccc5d31c93e22eb4179		 pdf-font-stream PDF embedded font (sfnt) at offset 0x45C1 7872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.