Malicious PDF — malware analysis report

Static analysis result for SHA-256 6dbaa8e970bc87af…

MALICIOUS

PDF

69.7 KB Authoring application: LibreOffice
MD5: e7e1cf028920932e9d6bcab4d96e3232 SHA-1: 9cec4fba9b0759fd3b0c64e356ef2f8b6091bd94 SHA-256: 6dbaa8e970bc87af03d3b3c28e990d91bbd06ab293d89f49314f769446d9853c
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

This PDF file was detected as malicious by ClamAV and an ML classifier, and exhibits a critical heuristic for a large external PDF link farm. The embedded URLs likely lead to further malicious content or phishing pages. No scripts were extracted from this sample, but the PDF structure itself is indicative of a malicious campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://acifte.org/uploads/1/3/0/4/130483288/7734491.pdf
    • http://prceducation.net/uploads/1/3/0/7/130775209/d6de428ed1312.pdf
    • http://altitudeexcavating.com/uploads/1/3/0/7/130740003/lidabajode.pdf
    • http://lisa-lindsey.com/uploads/1/3/0/5/130589189/xomajopod.pdf
    • http://bikseriet.com/uploads/1/3/0/6/130640220/suvidar.pdf
    • http://celebrationandpartysupplies.com/uploads/1/3/0/2/130287929/lezupi_rokilegof.pdf
    • http://nothincookiecutter.com/uploads/1/3/0/7/130738723/4927472.pdf
    • http://localsoho.com/uploads/1/3/0/2/130287960/bixumixofeki_zidozipex_volalab_bilexe.pdf
    • http://creedompublishing.com/uploads/1/3/0/6/130604378/a6ca75301820c32.pdf
    • http://athead.com/uploads/1/3/0/5/130539325/f1b1f63843.pdf
    • http://bodyworkandmeditation.net/uploads/1/3/0/6/130605190/xogikimutu.pdf
    • http://nelslehtinen.com/uploads/1/3/0/5/130588452/6c7dc48e3.pdf
    • http://codingfordocs.com/uploads/1/3/0/5/130539654/2632164.pdf
    • http://ahlamag.com/uploads/1/3/0/7/130775447/mosefuzitovij.pdf
    • http://collincurry.com/uploads/1/3/0/7/130739878/19551153.pdf
    • http://prettyininkbyci.com/uploads/1/3/0/7/130776601/7103486.pdf
    • http://judepurcell.com/uploads/1/3/0/7/130775834/130775834.html#cuadro+clinico+tuberculosis+pulmonar+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002df3.bin
cbdbf44c653d1676669efb6e569f42b298a3c9d8ab0706b7905237d538aad4c6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2DF3 9388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.