Malicious PDF — malware analysis report

Static analysis result for SHA-256 e6fc0dd9d6d3c992…

MALICIOUS

PDF

37.6 KB Authoring application: LibreOffice First seen: 2020-09-07
MD5: ebc967d10c1d1de2b08eb52e1829ab66 SHA-1: 8a0642324d3ccde2920a5845191b4e9c3044b6f5 SHA-256: e6fc0dd9d6d3c992edd94cbc8ece223e85f28999a959fa7009b12d7cd2cf10d8
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, indicating malicious intent. The primary attack pattern observed is a link farm, with numerous embedded URLs pointing to external PDF files. The document body contains seemingly random text and URLs, suggesting it is designed to evade simple content analysis while serving as a vehicle for these links. The presence of many external links strongly suggests a phishing or redirection attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mariaevangelizadoraradio.net/uploads/1/3/0/5/130589145/4424925.pdf In PDF document text
    • http://www.rememberingericcoates.com/uploads/1/3/0/6/130621228/gazip.pdfIn PDF document text
    • http://connexionadr.com/uploads/1/3/0/4/130483953/aac499dab1a.pdfIn PDF document text
    • http://modaallettante.com/uploads/1/3/0/6/130621791/jixarogegerux.pdfIn PDF document text
    • http://stevenyewmagic.com/uploads/1/3/0/9/130969501/bf740c754c2a2a6.pdfIn PDF document text
    • http://nofeebt.com/uploads/1/3/0/6/130639827/dobimuxi_rifufaxevukutoj_dodawoku_xifilunulu.pdfIn PDF document text
    • http://bellamayphotography.com/uploads/1/3/0/5/130540619/woluzexiran.pdfIn PDF document text
    • http://newportfamilyfarms.com/uploads/1/3/0/4/130435684/zitizaralotugor-wuguwitexewid-xizezosav.pdfIn PDF document text
    • http://confessionsofthehornychristian.com/uploads/1/3/0/7/130775254/nazilef.pdfIn PDF document text
    • http://liberty-rc.com/uploads/1/3/0/4/130483928/7803870.pdfIn PDF document text
    • http://madeiradrywall.com/uploads/1/3/0/5/130588221/gotakamokajob.pdfIn PDF document text
    • http://www.fortitudecapitalmgt.com/uploads/1/3/0/2/130287536/momolipa.pdfIn PDF document text
    • http://ctodesign.com/uploads/1/3/0/2/130289418/4819909.pdfIn PDF document text
    • http://minoritypodcast.com/uploads/1/3/0/3/130379818/dixezosep-solokujinexafe.pdfIn PDF document text
    • http://stillwaterfiretower.com/uploads/1/3/0/6/130639549/a7e6cbe8e1892b.pdfIn PDF document text
    • http://pitparts.net/uploads/1/3/0/7/130775279/siwujas.pdfIn PDF document text
    • http://geigersound.com/uploads/1/3/0/5/130551058/3609501.pdfIn PDF document text
    • http://kmcreecy.com/uploads/1/3/0/3/130313333/wolumolazuxogafo.pdfIn PDF document text
    • http://carlyzimmerman.com/uploads/1/3/0/2/130270813/mivevevemeworokupig.pdfIn PDF document text
    • http://soundvisiondecor.com/uploads/1/3/0/5/130544437/27ae7dfdd09652.pdfIn PDF document text
    • http://mojiles.net/uploads/1/3/0/3/130324005/gagepepiboj.pdfIn PDF document text
    • http://mathsgrant.com/uploads/1/3/0/7/130739558/2b7b1bea2c94333.pdfIn PDF document text
    • http://cpanel.callbuddys.com/uploads/1/3/0/5/130538988/rafisububodepu_jatenazunemu.pdfIn PDF document text
    • http://bet365tikuannagezuizhuanye.br3h.com/uploads/1/3/0/4/130476563/130476563.html#perirectal+abscess+with+fistula+icd+10In PDF document text

Related samples 3

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000030e7.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x30E7 7748 bytes
SHA-256: b1bcbcc9c7f93829c269125765fa74fb0b90d3ba595e0e81bf01a2f903c4ef96

Open this report in the interactive analyzer, or submit your own file for analysis.