Malicious PDF — malware analysis report

Static analysis result for SHA-256 89c94f577bc071d4…

MALICIOUS

PDF

38.5 KB Authoring application: LibreOffice Draw
MD5: a5d4acaf2a68888ebba9f1a22b631596 SHA-1: 1f7f06f2148fbd1532d7c74862b67ca0f8c5caa6 SHA-256: 89c94f577bc071d4465689d29ae6bfb5d105bce525f3c95bfc29947a557fe95b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This "link farm" technique is often used to obscure the ultimate malicious destination or to distribute malicious content across multiple sites. The ClamAV detection and ML classifier strongly indicate malicious intent, consistent with phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rishilsheth.com/uploads/1/3/0/2/130271097/gevobod.pdf
    • http://oakmont85south.com/uploads/1/3/0/6/130621477/7952926.pdf
    • http://sylvialeehome.com/uploads/1/3/0/4/130476556/9075354.pdf
    • http://sportsmed1.com/uploads/1/3/0/6/130640063/bubudo.pdf
    • http://www.roster.lsbrpc.net/uploads/1/3/0/4/130488574/422480f3ec9.pdf
    • http://skinnytiffy.com/uploads/1/3/0/2/130270982/pawop.pdf
    • http://thewardrobesquad.com/uploads/1/3/0/6/130639565/5167720.pdf
    • http://michellescreations.shop/uploads/1/3/0/7/130740496/9379000.pdf
    • http://p2pphotography.org/uploads/1/3/0/5/130539046/9a4d448f68d.pdf
    • http://pvqualityconstruction.com/uploads/1/3/0/4/130483318/518569.pdf
    • http://professionalresultsorganizing.com/uploads/1/3/0/6/130604748/kizumu.pdf
    • http://theminifigzone.com/uploads/1/3/0/6/130639551/negexuzarex.pdf
    • http://adayofhope.co/uploads/1/3/0/5/130544386/zuworozusego.pdf
    • http://nicholsonsbar.com/uploads/1/3/0/5/130539370/8258837.pdf
    • http://thedeepgame.com/uploads/1/3/0/3/130379232/5362413.pdf
    • http://bgflowermart.com/uploads/1/3/0/8/130814238/xosedaxa_vovobexisex.pdf
    • http://www.readoldhandwriting.com/uploads/1/3/0/6/130603819/fosedef.pdf
    • http://medicalpracticesolutions.net/uploads/1/3/0/5/130545885/zopixelupub.pdf
    • http://empirepersonaltraining.com/uploads/1/3/0/5/130588857/budila-kanuvifadobemud-nezezazowur.pdf
    • http://www.novelnaturesolutions.com.au/uploads/1/3/0/7/130739020/zedati.pdf
    • http://nfsparts.com/uploads/1/3/0/6/130620970/sisujinukiwefofusu.pdf
    • http://mninal.salon225.com/uploads/1/3/0/6/130621510/130621510.html#java+basic+tutorial+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003545.bin
6cafc0addcf3d39aa017550a89b6653fb6295e16b8b102f33caac12a7a9fb22f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3545 8232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.