Malicious PDF — malware analysis report

Static analysis result for SHA-256 d86e63c9e8aec56c…

MALICIOUS

PDF

45.8 KB Authoring application: LibreOffice Draw
MD5: cd1d9600a6de90dca0c9780568cc203c SHA-1: b98aa40bc88ba18c32bd66a74e340d24d5758ad8 SHA-256: d86e63c9e8aec56ca0091ca0374ec5040e781284c1bdbf522ed5a5a059e93b6e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical finding for a large number of external links, indicating a link farm. The ML classifier also assigned a high probability of maliciousness. The embedded URLs suggest a phishing or malware distribution campaign, where users are likely lured to download further malicious content. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mylifewater.nl/uploads/1/3/0/5/130551271/d2c8323be6d2c4.pdf
    • http://studentsenaterwu.com/uploads/1/3/0/4/130490221/befexusune_xesewolazetuj_vadamawe_xalala.pdf
    • http://rentmyhandymanhusband.com/uploads/1/3/0/5/130545818/9127158.pdf
    • http://nahomiichino.com/uploads/1/3/0/2/130288533/gowukexikata-vunajuxezut-buradafisituxaz-rofurutejafito.pdf
    • http://bespokebuildersinc.com/uploads/1/3/0/3/130323929/fepepefofoviripuz.pdf
    • http://newpstowing.com/uploads/1/3/0/5/130551656/7fef0.pdf
    • http://raykakobiella.com/uploads/1/3/0/4/130435843/vunajudasetiwagafi.pdf
    • http://rawly.net/uploads/1/3/0/7/130740598/d2eb8b499.pdf
    • http://soontravelagency.net/uploads/1/3/0/6/130604598/2547637.pdf
    • http://daniel-alexandru-beres.com/uploads/1/3/0/6/130603942/kizizutabugop_tosininusev.pdf
    • http://crosleyhome.com/uploads/1/3/0/6/130621459/6753872.pdf
    • http://localbitprice.com/uploads/1/3/0/5/130589435/jugonanam.pdf
    • http://sauerlandhypotheek.nl/uploads/1/3/0/2/130291910/130291910.html#online+vocabulary+games+for+esl+students

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001385.bin
b4b0fd4f962f6b8ebd6587cfd023c39c15ace7fa4e02223ae1e99edfda74cc2c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1385 8760 bytes
font_01_sfnt_off00006bce.bin
5d7ebd720715cd86529581f1d40cc643f68465477bd430d4be5ff736bc95f798		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6BCE 16268 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.