Malicious PDF — malware analysis report

Static analysis result for SHA-256 a59cc93f8a876c86…

MALICIOUS

PDF

34.7 KB Authoring application: LibreOffice Draw
MD5: eb082a15048dc6705cf14ab4d2e1f8cf SHA-1: 9de5a8f6c481c1f935e409afc260cc33146e62c7 SHA-256: a59cc93f8a876c8685faaf61ce69032a09b30a0db4e74dfbf93623b79c0cb956
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The PDF_SEO_LINK_FARM heuristic indicates the presence of a large number of embedded links, with the first identified URL being http://kathleenmartens.com/uploads/1/3/0/6/130605448/1e146.pdf. This suggests the document's primary purpose is to act as a lure, directing users to a network of potentially malicious or phishing-related PDF files hosted on various domains.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kathleenmartens.com/uploads/1/3/0/6/130605448/1e146.pdf
    • http://placeofthefuture.co/uploads/1/3/0/6/130620946/morifemekasazuzututu.pdf
    • http://homeownerenergyexchange.com/uploads/1/3/0/7/130739363/bd4bae7083c57a2.pdf
    • http://secure-building.com/uploads/1/3/0/3/130323255/sonigukosu.pdf
    • http://www.travauxdedition.com/uploads/1/3/0/7/130738850/fb1dc80b200.pdf
    • http://activopulse.com/uploads/1/3/0/5/130588606/7677681.pdf
    • http://marijuanalawvt.com/uploads/1/3/0/7/130776295/f0070edd.pdf
    • http://barringtonshutters.com/uploads/1/3/0/6/130620417/xakunolizotaxa.pdf
    • http://3rdgearwaseca.org/uploads/1/3/0/8/130814247/96d501af5.pdf
    • http://sysdep.xyz/uploads/1/3/0/6/130620557/5895106.pdf
    • http://avvocati4puntozero.it/uploads/1/3/0/4/130483825/395cc4990bc69.pdf
    • http://saskcorpservices.com/uploads/1/3/0/4/130490115/f7a82c0.pdf
    • http://watha.info/uploads/1/3/0/7/130776573/kidubolubunale.pdf
    • http://learnonlinefast.com/uploads/1/3/0/6/130605108/a4fdb0.pdf
    • http://mainestead.com/uploads/1/3/0/3/130379193/tavad.pdf
    • http://wcmcphailhomeinspections.com/uploads/1/3/0/6/130620631/7959820.pdf
    • http://shipfree.me/uploads/1/3/0/4/130488092/5962d1cf88f.pdf
    • http://fatboiish.com/uploads/1/3/0/2/130272937/2011068.pdf
    • http://ffcustomprints.com/uploads/1/3/0/7/130776402/sukono.pdf
    • http://flpeinture.com/uploads/1/3/0/5/130590461/pagujufapu.pdf
    • http://ns2.acedu.org/uploads/1/3/0/7/130739875/rewexete.pdf
    • http://61005.brdge.org/uploads/1/3/0/6/130620635/130620635.html#sears+craftsman+10+inch+radial+saw

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002920.bin
cbe03b77232912f48642a068360b3daef2824f756331d5b52081761e45077435		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2920 7196 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.