Malicious PDF — malware analysis report

Static analysis result for SHA-256 673c629e80e6b60c…

MALICIOUS

PDF

42.7 KB Authoring application: LibreOffice
MD5: 37b50a260bea635544fa406947cd8df0 SHA-1: 76cd5035e2f72eb9d93bddf84da4d01eadb81819 SHA-256: 673c629e80e6b60cacad995348e3fdaca86d3e2fa7f5376c368d705f9575d865
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. These links point to numerous PDF files hosted on various domains, suggesting a campaign to manipulate search engine results or distribute additional malicious content. The ML classifier and ClamAV detection further support the malicious nature of this file.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://northwesternbreastsurgeons.com/uploads/1/3/0/3/130323291/vuretaz.pdf
    • http://911-podarok.site/uploads/1/3/0/7/130739567/f1d1cc68.pdf
    • http://apsystem.ch/uploads/1/3/0/7/130739723/riniloxejokadoxulowe.pdf
    • http://radioholland.co.za/uploads/1/3/0/3/130323411/domumivejut.pdf
    • http://xyzhemp.net/uploads/1/3/0/6/130639398/nomibogejifim.pdf
    • http://al-nusr.net/uploads/1/3/0/6/130640010/bec6510.pdf
    • http://meduncookbaycolony.net/uploads/1/3/0/7/130740011/pozefupo-levonamonisimu-lamoviwedopoti.pdf
    • http://iterodentallab.com/uploads/1/3/0/5/130542781/satuvopup-fatewuve-tutor-gepus.pdf
    • http://keyconnect.net/uploads/1/3/0/6/130603941/7211510.pdf
    • http://mticonsultants.org/uploads/1/3/0/3/130323705/birejilewikimo_dapibasuzamu_vosipakutebonob.pdf
    • http://ccevenice.com/uploads/1/3/0/6/130621815/8e58dec01262.pdf
    • http://kohlsfoamsystemsmn.com/uploads/1/3/0/8/130874606/bobizopamixenib.pdf
    • http://406techteacher.com/uploads/1/3/0/5/130588487/lazuk_zowosofosup_vokifab.pdf
    • http://chrissybtherapy.com/uploads/1/3/0/4/130488121/toguru.pdf
    • http://mybodymysoul.org/uploads/1/3/0/5/130551697/guxumitosapus.pdf
    • http://mirandatinaphotography.com/uploads/1/3/0/6/130639465/576ef.pdf
    • http://senyumurta.com/uploads/1/3/0/6/130621385/47bb15.pdf
    • http://sikhcanadians.com/uploads/1/3/0/6/130639540/2414993.pdf
    • http://mail.psychotherapie-grupe.de/uploads/1/3/0/6/130620482/3372091.pdf
    • http://prettyininkbyci.com/uploads/1/3/0/7/130775232/8107414.pdf
    • http://mixedsf.com/uploads/1/3/0/6/130605228/f8840.pdf
    • http://biblesforchinaphotos.com/uploads/1/3/0/7/130739839/naxuzina.pdf
    • http://chantelle-shaw.com/uploads/1/3/0/7/130739758/f5b567c127.pdf
    • http://www.chiltoncreations.com/uploads/1/3/0/9/130969277/razikafilidirad.pdf
    • http://moisescastro.com/uploads/1/3/0/7/130776698/vavale.pdf
    • http://tartelaine.com/uploads/1/3/0/2/130287808/130287808.html#cuando+operar+una+hernia+umbilical+en+ni%C3%B1os

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000043d5.bin
d60eb0f84778409d2eb05f05845020c65e8b8bb277642e0ef6983fe747b1bae6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x43D5 8064 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.