Malicious PDF — malware analysis report

Static analysis result for SHA-256 ec9f68d9d07e8b8d…

MALICIOUS

PDF

38.4 KB Authoring application: LibreOffice Draw
MD5: fc488039a2ae6ac595af576f41219572 SHA-1: 46bcb6bf76ecdf5b10cf1b507cc6e980533d14b1 SHA-256: ec9f68d9d07e8b8d5ff376a0570e660d828bd0961bdfa13aa8b611d01146bc53
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of external links to other PDF files hosted on various domains, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or malware distribution campaign. The ML classifier and ClamAV detection strongly support the malicious verdict. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://kc-marketing.org/uploads/1/3/0/6/130639658/4566580.pdf
    • http://pirrellofamily.com/uploads/1/3/0/5/130588151/lijibabosarorun.pdf
    • http://mullinslawncarelandscape.com/uploads/1/3/0/6/130604798/4585752.pdf
    • http://www.estudiohoteles.com/uploads/1/3/0/5/130540282/zasagorifuniwunusawu.pdf
    • http://cyonsolutions.com/uploads/1/3/0/4/130476074/2573526.pdf
    • http://society.greenbrierhistorical.org/uploads/1/3/0/3/130313156/ripazepipa.pdf
    • http://natinelflowerslinensandrentals.com/uploads/1/3/0/7/130776609/5273728.pdf
    • http://www.send.snappysportsenter.com/uploads/1/3/0/2/130289640/rakodesojevefil.pdf
    • http://tsjgc.com/uploads/1/3/0/7/130739143/7766295432b2.pdf
    • http://objects-of-grace.com/uploads/1/3/0/2/130272420/pefatufiti_sipogoxek_xurorolipi.pdf
    • http://doylestcafe.com/uploads/1/3/0/4/130488578/fozopumunovoguleki.pdf
    • http://www.fallforfranklin.org/uploads/1/3/0/8/130813401/0703b83.pdf
    • http://managingsports.com/uploads/1/3/0/6/130621109/marux.pdf
    • http://templeofdeliverance.org/uploads/1/3/0/7/130776458/nowugizugux.pdf
    • http://adtrealty.org/uploads/1/3/0/8/130814081/cf36f48.pdf
    • http://moonmeart.com/uploads/1/3/0/4/130483682/8430d4127e76.pdf
    • http://dynamicsymmetryart.com/uploads/1/3/0/2/130272551/3767025.pdf
    • http://nickersongenealogy.net/uploads/1/3/0/4/130476921/kitizivozo-zeramefonov.pdf
    • http://displacedurbanite.com/uploads/1/3/0/5/130550847/3cbea6260408f.pdf
    • http://itssewfun.org/uploads/1/3/0/2/130291707/2ff845.pdf
    • http://drvnotfix.com/uploads/1/3/0/5/130590671/puxinimelis_zirox_gulifugufezuz.pdf
    • http://micahmakespots.com/uploads/1/3/0/6/130604656/3637517.pdf
    • http://nvution.fun/uploads/1/3/0/7/130775106/6520123.pdf
    • http://wildchild.dance/uploads/1/3/0/2/130289209/130289209.html#debrox+ear+wax+removal+kit
    • http://society.greenbrierhistorical.or

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003428.bin
7343ba0a68e8d84984592d622160eac447ea7a9426d38beb3a7babb9bdfba45b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3428 7708 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.