Malicious PDF — malware analysis report

Static analysis result for SHA-256 658b316d6424ceed…

MALICIOUS

PDF

32.2 KB Authoring application: LibreOffice
MD5: de03e2b7bdf330215b6d9076f3bc1486 SHA-1: beb9c5f5090f7006f10cd7b3f6a99a1ef1e36704 SHA-256: 658b316d6424ceed89a423b45a7bc5708d88cddf5377f42556639f2e68bb06b1
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, many of which are to suspicious domains and appear to be part of a link farm or SEO manipulation tactic. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution. While no scripts were explicitly extracted, the PDF structure and heuristics suggest it's designed to exploit users by directing them to malicious URLs.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gakobi.stapmstore.ru/uploads/2020/01/28/2475338.pdf
    • https://nazedubuzolefu.weebly.com/uploads/1/3/0/3/130379589/mejajagexadox_riped_wazefowetu.pdf
    • https://kuzagamotakafum.weebly.com/uploads/1/3/0/3/130313087/79758f9aa45999.pdf
    • http://insta-hot.ru/uploads/2020/01/27/478670.pdf
    • http://zowobotu.st-kino.ru/uploads/2020/01/28/8842194.pdf
    • https://vezirekawadas.weebly.com/uploads/1/3/0/5/130539642/jilotirud.pdf
    • http://xaxid.danielolivier.org/uploads/2020/01/29/kotul.pdf
    • http://zefigu.viktoria-karta.ru/uploads/2020/01/27/1177424.pdf
    • http://securepaytinkof.online/uploads/2020/01/28/3647186.pdf
    • https://fewokazofuv.weebly.com/uploads/1/3/0/4/130483631/3574e553c.pdf
    • https://xaboxabotobow.weebly.com/uploads/1/3/0/2/130271002/rixelupokujoxov-sogasisubifuga.pdf
    • http://7272oldtown.com/uploads/1/3/0/4/130483205/3697147.pdf
    • http://zabibo.galaxycom.ru/uploads/2020/01/28/8314807.pdf
    • http://ademismedical.com/uploads/1/3/0/6/130605273/sevisamepo-nupuzurajuv-gakenareg.pdf
    • http://choosewhentowork.com/uploads/1/3/0/3/130379219/9ad112569c2b1.pdf
    • http://101namvet.com/uploads/1/3/0/5/130546076/8636922.pdf
    • https://fomakumu.weebly.com/uploads/1/3/0/2/130289265/sowukem_werupegur_jupeka_rojowujowuz.pdf
    • http://xagiduboza.gate2019iitm.online/uploads/2020/01/27/33f0be2002e.pdf
    • http://barcelonaswing.cat/uploads/2020/01/27/5922593.pdf
    • http://kcbevco.com/uploads/1/3/0/4/130475901/130475901.html#the+film+experience+an+introduction+5th+edition

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001560.bin
42a0366ed60a330f7eae20618b2f33a27d8b44c8f9b073720de0e911c051c2f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1560 7532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.