Malicious PDF — malware analysis report

Static analysis result for SHA-256 ef88efbf8d9ce386…

MALICIOUS

PDF

38.0 KB Authoring application: LibreOffice
MD5: dfc8a1307267cb7a9dd0802001b1fb2e SHA-1: 42b14f4a34e4ca1bd54a4fc4e8c8bde647b06eaa SHA-256: ef88efbf8d9ce386ecfe00fd996ad995c27e7962e1c8fb8dd70bf832ea1e41d2
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

This PDF file was flagged by multiple heuristics as malicious, including a critical ClamAV detection for 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The primary attack pattern observed is a large link farm pointing to external PDF files, suggesting a phishing or SEO manipulation scheme. The embedded URLs are the highest priority IOCs for this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dato.wesharehk.com/uploads/2020/01/27/pufifibonolojile.pdf
    • http://ncrage.com/uploads/1/3/0/5/130539908/xuxaxan_fezakazigijoj_goxutini.pdf
    • http://lclreporter.com/uploads/1/3/0/6/130620564/9490498.pdf
    • http://tula-teplo.ru/uploads/2020/01/28/biges.pdf
    • https://walikawunamabag.weebly.com/uploads/1/3/0/3/130313484/rigimozagim.pdf
    • http://sose.thebestessay.info/uploads/2020/01/28/duzeferew_guzada_zevan_daxix.pdf
    • http://mrandersonllc.com/uploads/1/3/0/3/130312969/bimarudoj.pdf
    • http://djsacademy.com/uploads/1/3/0/5/130543784/fowefipapefo_jizer.pdf
    • http://planeandsimple.ca/uploads/1/3/0/6/130604251/e4247c1.pdf
    • http://paradisecitybeach.com/uploads/1/3/0/6/130621790/8110849.pdf
    • http://sepu.1000bitcoinhomepage.com/uploads/2020/01/27/gudade-vitudekiwuraw-jegajiferunupag.pdf
    • http://vollair.com/uploads/1/3/0/4/130490218/600591328c4aac.pdf
    • http://zew.sietmexico.com/uploads/2020/01/27/8938106.pdf
    • https://jugozukasunuz.weebly.com/uploads/1/3/0/5/130540037/b401ec4c2b62b.pdf
    • http://yumishop.vip/uploads/1/3/0/6/130620890/rerira.pdf
    • http://ruanntiller.com/uploads/1/3/0/6/130605133/3760518.pdf
    • http://luckylucianorottweilers.com/uploads/1/3/0/3/130379081/1706063.pdf
    • http://100lifelessonswithsistergirl.com/uploads/1/3/0/5/130539267/780414.pdf
    • http://transcaisse.ca/uploads/1/3/0/4/130483305/caa3afc34.pdf
    • http://marketingforsalessuccess.com/uploads/1/3/0/6/130621857/130621857.html#affine+and+projective+geometry+bennett+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001542.bin
5eb67a42281d5fe76ac78578266b381291ab7358c89dd2c2d3a8757a17a2e73e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1542 7680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.