Malicious PDF — malware analysis report

Static analysis result for SHA-256 078e3a7cab82fbd5…

MALICIOUS

PDF

58.6 KB Authoring application: OpenOffice.org
MD5: ac55f960ba0cd9e8955e260f17ebc058 SHA-1: 9308c569548acb11751ac8798899bc33ad480678 SHA-256: 078e3a7cab82fbd5368d04ce2d311540a68ff2bbd6889eb9deadf78407a3ca12
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to host malicious content. ClamAV and ML classifiers also flagged this file as malicious, specifically identifying it as a phishing or robot-install related threat. No scripts were extracted, but the sheer volume of external links suggests a coordinated effort to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.dimsampaio.org/uploads/1/3/0/6/130639905/sifofafiminen_sekuzizurel.pdf
    • http://coleshill.com/uploads/1/3/0/3/130379770/fikupog_jewowikapepe.pdf
    • http://rikkibox.com/uploads/1/3/0/4/130483963/46dca743.pdf
    • http://kathleenschubitz.rpjandco.com/uploads/1/3/0/3/130379492/zaxugul.pdf
    • http://811x.org/uploads/1/3/0/8/130873710/ritunovuf_jirudetaku_xoxav_ximevev.pdf
    • http://pressurewashingtorrance.com/uploads/1/3/0/7/130740375/6831131.pdf
    • http://meerreport.net/uploads/1/3/0/5/130551343/kuvexekev-zugidivofuvu-mojonez-ponep.pdf
    • http://thegeeksdomain.com/uploads/1/3/0/7/130738593/cea5fd405.pdf
    • http://norascully.com/uploads/1/3/0/5/130539888/pitit_rekanazowodefof_gavalivemuso.pdf
    • http://augmentedbizcards.com/uploads/1/3/0/2/130287847/pawuzosurusurov.pdf
    • http://www.jpactm.com/uploads/1/3/0/4/130477085/lunoxewefef-katoripujoven-gasegusawijo.pdf
    • http://uktvspainuk.com/uploads/1/3/0/7/130738951/fe55f.pdf
    • http://tweetni.com/uploads/1/3/0/2/130291552/kutujikabarisak-faxigabagato-vemodid.pdf
    • http://zedinburgh.com/uploads/1/3/0/8/130814001/9709728.pdf
    • http://f4lmi.slpny.com/uploads/1/3/0/9/130969824/130969824.html#filmora+wondershare+free
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000fd3.bin
831faf4472466dfd81453907dfa5f12891cb9e11b6b6d4179aaa2f9870a92073		 pdf-font-stream PDF embedded font (sfnt) at offset 0xFD3 9392 bytes
font_01_sfnt_off00009462.bin
45c39c4315a5d00962143d4102937301eb2649728d6de39b959633cfc30365c3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x9462 16144 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.