Malicious PDF — malware analysis report

Static analysis result for SHA-256 d6409bdd329f6d07…

MALICIOUS

PDF

43.1 KB Authoring application: LibreOffice
MD5: 12400997206d7b622774ead118301fdb SHA-1: 755bcbae2125b381b534f9f9ee06371fb661da90 SHA-256: d6409bdd329f6d07dd0ff4ca8ff2a83303aa14f58cbe244b7d624344f468ded9
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The critical PDF_SEO_LINK_FARM heuristic fired, identifying a mass of external links within the document. These links, such as http://www.the-odc.net/uploads/1/3/0/9/130969874/7046213.pdf, are likely used to redirect users to phishing sites or download further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.the-odc.net/uploads/1/3/0/9/130969874/7046213.pdf
    • http://animalmatters.com.au/uploads/1/3/0/7/130739324/7638445.pdf
    • http://moannasworkroominteriorsandstaging.com/uploads/1/3/0/7/130776331/3c063ba0d9e4.pdf
    • http://showgirl.life/uploads/1/3/0/4/130435791/mexid.pdf
    • http://dabispop.com/uploads/1/3/0/6/130621809/220ab832d19fed.pdf
    • http://adamhamdy.net/uploads/1/3/0/7/130739809/nomularixorefo-ximeza.pdf
    • http://xddb.org/uploads/1/3/0/4/130489226/riberig.pdf
    • http://inqeparo.com/uploads/1/3/0/5/130588461/7e5da.pdf
    • http://losangelescommercialpropertymanagement.com/uploads/1/3/0/3/130379199/3062317.pdf
    • http://algaebookandpaper.com/uploads/1/3/0/4/130490928/dinamewij.pdf
    • http://thefootballbettingpredictor.com/uploads/1/3/0/2/130288684/dd4123a72.pdf
    • http://crowdsoloution.com/uploads/1/3/0/7/130775503/rofesegog_fepinomekam_jexozalumi_direzodaw.pdf
    • http://carcreditfix.net/uploads/1/3/0/7/130775800/nuxot.pdf
    • http://armyvetwear.com/uploads/1/3/0/6/130639517/dovifi.pdf
    • http://www.curvybridesri.com/uploads/1/3/0/5/130550666/5957411.pdf
    • http://shootingcourse.space/uploads/1/3/0/8/130874371/6390275.pdf
    • http://rootsgen.net/uploads/1/3/0/8/130874134/8981911.pdf
    • http://heartfeltsong.com/uploads/1/3/0/7/130740045/c5eba2629627f4.pdf
    • http://lottomagico.com/uploads/1/3/0/2/130289793/vojulajel-ruvekewu.pdf
    • http://damathitsar.com/uploads/1/3/0/7/130740129/c186e.pdf
    • http://mosaicwellington.org/uploads/1/3/0/2/130289310/juzibemiwaf.pdf
    • http://1tei2.slpny.com/uploads/1/3/0/3/130313613/130313613.html#dictionnaire+anglais+fran%C3%A7ais+technique+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000047c6.bin
10599da77c45f4887010a573f7aa369f0683184e9c0dabf2b4104644d97fd4e0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x47C6 9036 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.