Malicious PDF — malware analysis report

Static analysis result for SHA-256 6bdbd9056cbdb08a…

MALICIOUS

PDF

40.8 KB Authoring application: LibreOffice Draw
MD5: 93fc3d02e258dd48627b04088979277b SHA-1: 8213fe86b1f70de1f5fa2932f36a85b2d54a2736 SHA-256: 6bdbd9056cbdb08a6c1e5c5b51ea09ca85f617950889be5a5774386420fb56fd
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs, many of which point to other PDF files, indicating a link farm or a mechanism for distributing further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly suggest malicious intent. The embedded URLs likely serve as a lure or a distribution point for additional malware, potentially related to phishing or SEO manipulation.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://crumpgreenhouse.com/uploads/1/3/0/6/130604859/507333.pdf
    • http://paduzuvug.ngochastore.com/uploads/2020/01/28/xaroborago-pelovaveken-duninoda-tagoxaxeremafa.pdf
    • http://shenyuanfan.com/uploads/1/3/0/6/130621675/3047471.pdf
    • http://kyxros.com/uploads/1/3/0/5/130551374/dakisuleguzeregidaz.pdf
    • http://mvcatching.com/uploads/1/3/0/6/130620195/49c1ae406dc7241.pdf
    • http://dad.maquinariayequipoindustrial.online/uploads/2020/01/28/28479f15e0de6f1.pdf
    • http://drjolieweingeroff.com/uploads/1/3/0/4/130483757/6529805.pdf
    • http://reasonable-person.com/uploads/1/3/0/5/130588936/xajijoverefedamuma.pdf
    • http://sunpropertypeople.store/uploads/2020/01/29/mujejuburagujak.pdf
    • https://wabapupimulo.weebly.com/uploads/1/3/0/5/130539247/f3f1563fec7f.pdf
    • http://myfinlandlimerence.com/uploads/1/3/0/6/130621867/kozonutisaj.pdf
    • http://jo-ocean.com/uploads/1/3/0/5/130588997/d9dd2337a5.pdf
    • http://3csstudios.com/uploads/1/3/0/5/130544703/ffdd69992df.pdf
    • http://medmico-h2020.com/uploads/1/3/0/5/130539866/f6ee44829622.pdf
    • https://pemivarup.weebly.com/uploads/1/3/0/3/130313152/sifatopinafo.pdf
    • http://metiscollege.ca/uploads/1/3/0/5/130551618/0e439f4f.pdf
    • http://sistereducator.com/uploads/1/3/0/5/130590384/puwadizarofosu_gamixotizu_ranap_wodoj.pdf
    • http://mrjrealtalk.com/uploads/1/3/0/4/130476697/3310596.pdf
    • http://miquelroig.com/uploads/1/3/0/4/130483205/mazomorujoxoxi-xuwamiremopuj-bunuluzenir.pdf
    • http://azpadu.com/uploads/1/3/0/5/130538831/sobupatoxiwijejinaj.pdf
    • http://totuf.centrmebliv.com/uploads/2020/01/28/4227314.pdf
    • http://fintoro.com/uploads/1/3/0/5/130539355/3a57d96bbbe.pdf
    • http://myfampow.com/uploads/1/3/0/6/130621917/a95af056a29.pdf
    • http://yolozwolle-lekkerpuh.nl/uploads/1/3/0/6/130604812/130604812.html#pokemon+red+guide+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016e0.bin
7bc629d90a675c67e755afb38c4bfb797d8f2ca4d154c5f57973ccb6d96130c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16E0 8208 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.