Malicious PDF — malware analysis report

Static analysis result for SHA-256 761f2560db9ef35f…

MALICIOUS

PDF

79.4 KB Authoring application: LibreOffice
MD5: aa7cbf5c4f99b9ca31af38ca29b67861 SHA-1: e2d216a00b4ebb21d40da31cd645dc316a5174e6 SHA-256: 761f2560db9ef35f1c5e1001c97498ed2e2d3eabf4f1504cf68aaadb06e63ddc
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate maliciousness. The primary attack pattern involves directing users to a link farm of potentially malicious documents.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://activatemelbourne.com.au/uploads/1/3/0/6/130620168/kozisaloza-galalufunoseret-tabebopofos.pdf
    • http://nxtgenacademy.com/uploads/1/3/0/4/130488811/kevovuwotisugej.pdf
    • http://www.912foryou.com/uploads/1/3/0/8/130874212/vajirubusuna.pdf
    • http://www.t6customtees.com/uploads/1/3/0/6/130621006/vevapesoka.pdf
    • http://prettyunik.com/uploads/1/3/0/7/130775014/1aabbab10e0055.pdf
    • http://part-timecfo.net/uploads/1/3/0/3/130323236/tunumux-jitajupubefi-donopokikevuvuw.pdf
    • http://mooiskin.net/uploads/1/3/0/7/130775396/4567676.pdf
    • http://katiefinkevents.com/uploads/1/3/0/9/130969335/wovugazisurod.pdf
    • http://parnelldrum.studio/uploads/1/3/0/4/130488631/xipal.pdf
    • http://www.korumall.com/uploads/1/3/0/5/130540176/dugunokaxazawak-kilepuduzufoz-zukawek-wokudiweteka.pdf
    • http://www.daisyhillminisilkyfaintinggoats.com/uploads/1/3/0/7/130740086/moxidalitinuwe_webaxigakufuz.pdf
    • http://www.mcallisterstudios.com/uploads/1/3/0/5/130551362/denawarum_zedome_mitizije.pdf
    • http://morewirehouseandanimal.com/uploads/1/3/0/4/130492229/95704.pdf
    • http://geek-street.jigsaw-group.co.uk/uploads/1/3/0/3/130379522/guwer_vuzos.pdf
    • http://holthealth.com.au/uploads/1/3/0/6/130639869/3693932.pdf
    • http://hostmaster.coach-michael.com/uploads/1/3/0/6/130604944/nejuduwuz_goropopad_jezezo_sivugezorepew.pdf
    • http://pillarsofart.com/uploads/1/3/0/8/130874039/rupoxofunele.pdf
    • http://eurekaarchitecture.com/uploads/1/3/0/4/130488688/7d80765be56.pdf
    • http://www.motorsportsdirt.com/uploads/1/3/0/7/130739802/5a098cde.pdf
    • http://thedroneinvasion.com/uploads/1/3/0/6/130621382/416a3c97a90230d.pdf
    • http://anchorfertilitycare.com/uploads/1/3/0/3/130379199/sazusavefaraf-woxupaxamujir.pdf
    • http://zhajinhuayulecheng.br3h.com/uploads/1/3/0/8/130814118/130814118.html#abraham+maslow+wikipedia+romana
    • http://geek-street.jigsaw-group.co.uk/uploads/1/3/0/3/130379522/g

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002be2.bin
d6953824df5c0cab3d4f97f5ff62ed10bda4d2de7c35790999d97264ecb0fea6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2BE2 8984 bytes
font_01_sfnt_off0000f1c5.bin
9c70772738280065930db61d29b0eee79557f8152c8dc8c27cbb99d0b6b3e0b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF1C5 16200 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.