Malicious PDF — malware analysis report

Static analysis result for SHA-256 e7dc65147c4f9487…

MALICIOUS

PDF

38.2 KB Authoring application: LibreOffice
MD5: b1a6348359fb7e1a8afcd0b946be37fb SHA-1: a036ae4253646cb6ab9b0f825857ed7a0c6f720c SHA-256: e7dc65147c4f94873c8b32603907be3fa84478b1b87d4b30da263b57d533d7b7
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF document contains a link farm of 11 external PDF files, disguised as a tool to convert AutoCAD files to PDF. This is a common phishing lure to trick users into downloading malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent, likely related to phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://namastead.com/uploads/1/3/0/7/130775965/fisefakubifow.pdf
    • http://74-123-76-151.mgwnet.com/uploads/1/3/0/2/130272474/vepim-jemesu.pdf
    • http://northcitycoc.org/uploads/1/3/0/4/130489149/koroxigikilexavox.pdf
    • http://palmbeachcaregroup.com/uploads/1/3/0/6/130620436/5187241.pdf
    • http://nwm3.club/uploads/1/3/0/2/130289161/wuduwosekemik.pdf
    • http://mywobblyireland.com/uploads/1/3/0/6/130639675/vamekawejuw_xexuta_torokon.pdf
    • http://yarnandsass.com/uploads/1/3/0/5/130539319/jivikuzevaneku.pdf
    • http://zakariyadurag.com/uploads/1/3/0/4/130489172/3240495.pdf
    • http://moonlightairfoundation.org/uploads/1/3/0/5/130539516/40a2c69f49.pdf
    • http://mail.tashi-delek.ch/uploads/1/3/0/7/130775252/lozujubozuzewi.pdf
    • http://aspenleafproductions.com/uploads/1/3/0/8/130814308/sowag.pdf
    • http://iyjpb.bpmtc.com/uploads/1/3/0/2/130272973/130272973.html#how+convert+autocad+file+to+pdf
    • http://mail.tashi-delek.ch/uploads/1/3/0/7/130

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ea2.bin
dfde35e4696f4755be40fa5fbecd390adf9877f5726cc975286b6a7f1ed31d30		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3EA2 7868 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.