Malicious PDF — malware analysis report

Static analysis result for SHA-256 7d8ee0e3b44d8ab5…

MALICIOUS

PDF

60.6 KB Authoring application: LibreOffice Draw
MD5: 6d16135616b60b2b6469dcb1ee2e0456 SHA-1: eccd3861cbfb4bb373185750d41a9fb066daa78f SHA-256: 7d8ee0e3b44d8ab5d5413d62156b1106c4d3ba3af1b71e268d14da40ba743e5a
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF document was flagged by multiple heuristics, including a critical finding for a large number of external PDF links, and a machine learning classifier. ClamAV identified it as Pdf.Phishing.TtraffRobotInstall-7605656-0. The document body contains numerous URLs, suggesting a phishing or content-farming scheme designed to redirect users to malicious sites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://karewad.landysheva.ru/uploads/2020/01/27/boful.pdf
    • http://evokefitness.net/uploads/1/3/0/4/130483584/3688038.pdf
    • http://placentaedmonton.ca/uploads/1/3/0/6/130604295/7466211.pdf
    • http://shopcenter17.fun/uploads/2020/01/28/12594.pdf
    • http://allthesedays.org/uploads/1/3/0/5/130543256/2898900.pdf
    • http://gamings-fb.com/uploads/2020/01/28/wewuvar.pdf
    • http://dug.sparepartsjumberca.com/uploads/2020/01/28/zawiluzojupivimigufo.pdf
    • http://loskuatro20decalifornia.com/uploads/1/3/0/5/130547515/muwovip.pdf
    • http://basketball-skills-training.com/uploads/1/3/0/5/130545733/tajebevobas-garuvakije-murexi.pdf
    • https://dobebetiza.weebly.com/uploads/1/3/0/6/130603747/af12c1187d894.pdf
    • https://degaroxofofufaj.weebly.com/uploads/1/3/0/2/130272557/kanuguxelit-lonuga.pdf
    • http://alloexo.solutions/uploads/1/3/0/2/130289765/5979610.pdf
    • http://wokuse.w7and.net/uploads/2020/01/29/c2d3b6aba5.pdf
    • http://lesimprimespersonnalises.com/uploads/1/3/0/5/130551581/biwegegagagolulu.pdf
    • http://newbusinessdevelopment.net/uploads/1/3/0/2/130291822/72d27383fb4.pdf
    • https://marudojejoz.weebly.com/uploads/1/3/0/6/130605212/942a2764.pdf
    • http://alpha-hhh.com/uploads/1/3/0/5/130588928/130588928.html#men%27+s+style+guide+reddit

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001547.bin
352ed805d90f782bf7dccdd7ff8f689cb0b63d8f5d0919d03b993d2f72b2e31d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1547 9380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.