Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1660eccd5b448a4…

MALICIOUS

PDF

37.1 KB Authoring application: LibreOffice Draw
MD5: dd19c2dde2abb1da46e2f7d584d35476 SHA-1: 35f6cdbfffb34880fb4f862185ce80530dec6bb4 SHA-256: c1660eccd5b448a434837e697c965f390a9ed5e36e5f6defc78a61d048010743
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, a technique commonly used in SEO poisoning and phishing campaigns to redirect users to malicious sites. The ClamAV detection and ML classifier strongly indicate malicious intent. The primary attack pattern involves a link farm designed to lure users into downloading further malicious content, likely PDFs, from compromised websites.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://slatteneyecare.com/uploads/1/3/0/2/130272352/8be116f23.pdf
    • http://wirur.e-loveparis.com/uploads/2020/01/28/5904342.pdf
    • http://coplandia.com/uploads/1/3/0/5/130539691/f7321def.pdf
    • http://diwig.sportsrt.com/uploads/2020/01/28/mewabomebuzil.pdf
    • http://619756869709789420.com/uploads/1/3/0/3/130323517/dasorirupumubi_wozupin_vavefad_tapaj.pdf
    • http://byronestates.com/uploads/1/3/0/4/130490561/minotonaxanevaw.pdf
    • http://moritzscience.com/uploads/1/3/0/6/130603789/4346352.pdf
    • https://mefuwaviwakal.weebly.com/uploads/1/3/0/5/130544147/022b0.pdf
    • https://tolixexokasepi.weebly.com/uploads/1/3/0/5/130551114/dc9d2a7.pdf
    • https://kojiluxo.weebly.com/uploads/1/3/0/2/130291539/3394551.pdf
    • http://grandcredit.pro/uploads/2020/01/28/580530.pdf
    • http://toocoolforlawschool.com/uploads/1/3/0/3/130323146/xutekuvodorewebed.pdf
    • http://nataliekopitzke.com/uploads/1/3/0/6/130604048/fepaluzemurigewowo.pdf
    • http://sdaerospace.com/uploads/1/3/0/5/130550663/nojutugazewoba-bired-kisapugemes.pdf
    • http://royaldaiimond.com/uploads/1/3/0/5/130590717/zasebariviv.pdf
    • http://alyssaoeder.com/uploads/1/3/0/6/130604598/1821840.pdf
    • https://fatixebo.weebly.com/uploads/1/3/0/6/130604606/7d8b1ab.pdf
    • http://ankezimmermann.ca/uploads/1/3/0/6/130604672/130604672.html#linear+sequences+differentiated+worksheet

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000014bd.bin
26febc192c457cff7b04653cb1c03f4e6d0d976b8febbb42a49134004eb0b4b6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14BD 8472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.