Malicious PDF — malware analysis report

Static analysis result for SHA-256 a6b17ba9b66cd753…

MALICIOUS

PDF

86.8 KB Authoring application: LibreOffice Draw
MD5: 09880f2213f4bec6275fe97fb3fdaf35 SHA-1: 77fadfed6604227b21ed06fe4e054ace6fcfdd62 SHA-256: a6b17ba9b66cd7537151f7542adb250273f29d07a9ba634702936ef781160064
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, identified as a link farm, designed to redirect users to malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, specifically classified as phishing. The document body, though partially corrupted, mentions book downloads and donations, serving as a lure to encourage users to click on the embedded links, which likely lead to further malicious payloads.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cfthomas.com/uploads/1/3/0/3/130379818/9e160f4948d577d.pdf
    • http://theporterauthority.com/uploads/1/3/0/2/130288458/vobazinu_jizelatut.pdf
    • http://afuture-ahope.com/uploads/1/3/0/5/130539084/dejum.pdf
    • https://bikefavitajeke.weebly.com/uploads/1/3/0/4/130490786/mowimulofelikuralo.pdf
    • http://majewa.trytoberich.com/uploads/2020/01/28/zijolitejagutul.pdf
    • http://pantsbysamstore.com/uploads/1/3/0/5/130540585/cae2762cf8.pdf
    • http://naturalproductsbyshensare.com/uploads/1/3/0/2/130289240/kimukizivogere_sejegedokaxutaf.pdf
    • http://monarchrev.com/uploads/1/3/0/2/130270903/pikubetotawakat_wulonexi.pdf
    • http://waxedbylaurie.com/uploads/1/3/0/5/130589269/8538119.pdf
    • https://vapajulit.weebly.com/uploads/1/3/0/4/130476158/4406757.pdf
    • http://weddingwellsevents.com/uploads/1/3/0/6/130620348/4857a5184819ba0.pdf
    • https://vepaxemamarifi.weebly.com/uploads/1/3/0/5/130539279/2852356.pdf
    • http://endoflifedoula.co/uploads/1/3/0/6/130604495/xikepo.pdf
    • http://mountshastamassage.com/uploads/1/3/0/4/130476525/bonofoxiguj-pizafawemewib-botalafisik-zegozo.pdf
    • http://kizorolaxa.transcom78.ru/uploads/2020/01/29/f0581917348c51.pdf
    • http://susitixet.bp-bas.com/uploads/2020/01/28/2734225.pdf
    • http://beingself-centered.com/uploads/1/3/0/6/130621479/130621479.html#anna+karenina+book+online+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017a5.bin
d6c0fe79d0ff6263ae9aa25121da201829db1224f8c1b4a0cb1b499defb8d965		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17A5 13472 bytes
font_01_sfnt_off000073aa.bin
9102625ab4f0b0a2797a738196340a632445b61725ad73edcc04e1c52b05bcb6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x73AA 16744 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.