Malicious PDF — malware analysis report

Static analysis result for SHA-256 65d52e72b1266fcf…

MALICIOUS

PDF

36.6 KB Authoring application: LibreOffice Draw
MD5: 6db45552f3ab5ad2d89531a1ac8f7bea SHA-1: 24ca38d878531f344407818e48d33fb768655827 SHA-256: 65d52e72b1266fcf0cabf66a5d8e7b4a171003ff3474d57d6b6a8e914975ff2b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection and ML classifier also indicate maliciousness, specifically flagging it as phishing-related. The primary attack pattern involves directing users to a vast array of external PDF files, likely to manipulate search engine rankings or distribute further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vcareheatingandplumbing.com/uploads/1/3/0/5/130550931/889aef3283fc.pdf
    • http://terapiaregresiva.org/uploads/1/3/0/7/130738658/14c13.pdf
    • http://esyllabusforafrica.org/uploads/1/3/0/8/130874600/fc664f4aa.pdf
    • http://myanalogworld.com/uploads/1/3/0/4/130483817/linapoludikaromu.pdf
    • http://manualdeingles.com/uploads/1/3/0/2/130288458/bivikewugozuvak.pdf
    • http://ja-sauer.family/uploads/1/3/0/4/130476370/382c9b.pdf
    • http://usdaum.one/uploads/1/3/0/3/130313145/3f85c6fbb98.pdf
    • http://didsburysmiles.com/uploads/1/3/0/7/130775592/261c5.pdf
    • http://zagi.net/uploads/1/3/0/2/130289161/fe7777d9860.pdf
    • http://nancymaldonado.com/uploads/1/3/0/2/130271098/kenevimapokogu.pdf
    • http://mieterbeirat.eu/uploads/1/3/0/8/130874231/mulizinugipedeg.pdf
    • http://slatteneyecare.com/uploads/1/3/0/7/130776385/zigixe.pdf
    • http://dallaslivesinc.com/uploads/1/3/0/5/130589054/48187eaf1e07c6b.pdf
    • http://mmccolorado.online/uploads/1/3/0/5/130588394/vupabewabuw_xodib.pdf
    • http://cycotron.com/uploads/1/3/0/5/130546804/gisinemokovupopu.pdf
    • http://risemexico.org/uploads/1/3/0/6/130604768/2609970.pdf
    • http://bigfootpipeline.com/uploads/1/3/0/5/130588845/wedemifurowakex.pdf
    • http://zhcw.brdge.org/uploads/1/3/0/3/130313191/130313191.html#ikea+online+uk

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003267.bin
64e7e605f642483302827796468ef0afed58ccb1594c77865e463ec980eb7e39		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3267 8112 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.