Malicious PDF — malware analysis report

Static analysis result for SHA-256 79d92e0bd662f9a7…

MALICIOUS

PDF

36.7 KB Authoring application: LibreOffice
MD5: 590a27c0d8e754cc883be99315770086 SHA-1: 7e24c37015c7236e7b7b4c8a93d65c9581ada593 SHA-256: 79d92e0bd662f9a7817f22be8045a1b6d62cddd0bdceb557ef022d5b21d69898
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The critical PDF_SEO_LINK_FARM heuristic indicates the presence of a large number of external PDF links, suggesting a link farm or distribution mechanism. While no scripts were explicitly extracted, the nature of the PDF and the numerous embedded URLs point towards a phishing or malicious content distribution campaign.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://orthogistic.com/uploads/1/3/0/5/130589239/lapub.pdf
    • http://em636jpf2019.com/uploads/1/3/0/8/130813111/duvegipuxo.pdf
    • http://kimbescorner.com/uploads/1/3/0/4/130436451/josowuxoxisevefotar.pdf
    • http://triciazoellerauthor.com/uploads/1/3/0/5/130588622/764d261.pdf
    • http://mta-sts.mail.zombodroid.com/uploads/1/3/0/3/130313114/senuno-tokelorabarujut-tidujuj.pdf
    • http://machinegeneral.net/uploads/1/3/0/6/130622025/978746.pdf
    • http://biblewordstudy.org/uploads/1/3/0/3/130324292/pologoxalotubaja.pdf
    • http://sweetsadiesdoggieboutiqueonline.com/uploads/1/3/0/5/130588546/mebikupokezufidifep.pdf
    • http://thepowergroupnc.com/uploads/1/3/0/5/130590383/326f1d15e668b36.pdf
    • http://www.christinevanwalraven.com/uploads/1/3/0/6/130621167/2f60deb7126d81.pdf
    • http://threadsolelife.com/uploads/1/3/0/7/130775180/tebogiziwujoveto.pdf
    • http://thelentexperiment.com/uploads/1/3/0/2/130272877/tekad.pdf
    • http://drberrytherapy.com/uploads/1/3/0/4/130483867/pojoxolanafusib_papogigogiz_vejosonoz.pdf
    • http://iguazugrandhotel.net/uploads/1/3/0/2/130287867/tosolutepiboxiz.pdf
    • http://64-148-55-33.tfpackagers.com/uploads/1/3/0/3/130323526/eaf22aaa.pdf
    • http://camptownladies.com/uploads/1/3/0/4/130476539/4438791.pdf
    • http://agapibeach-akamaiorigin.devsite-1.com/uploads/1/3/0/3/130379178/130379178.html#blues+guitar+licks+tabs

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033c9.bin
15aa67abaa0c76511170256deaceeb81a9cca15a0562adc52e1af9c9ebff11be		 pdf-font-stream PDF embedded font (sfnt) at offset 0x33C9 7768 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.