Malicious PDF — malware analysis report

Static analysis result for SHA-256 0ad6b533fa76dc41…

MALICIOUS

PDF

57.6 KB Authoring application: LibreOffice
MD5: 77fcb70598f0ac7a45c8d0854214c351 SHA-1: 20544b17943aef456e9494d6cb6baa013c674351 SHA-256: 0ad6b533fa76dc412e2d684b953a092db6270fbe4a870f0cd6c3ecce3e2ff312
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a mass external link farm pointing to other PDF files, a common technique for SEO spam or phishing campaigns. The heuristic 'SE_DOWNLOAD_BUTTON' indicates the presence of a visual download lure, reinforcing the malicious intent. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further confirms its classification as phishing malware.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://metaprotection.com/uploads/1/3/0/5/130588948/goramezavapisoji.pdf
    • http://momentumdanceandfit.com/uploads/1/3/0/5/130551677/9670358.pdf
    • http://octobercrickets.net/uploads/1/3/0/6/130621422/c5516149e096.pdf
    • http://autodiscover.nativeplantslivehere.com/uploads/1/3/0/7/130775870/5911043.pdf
    • http://sironaliving.net/uploads/1/3/0/8/130813571/1559023.pdf
    • http://nochemicalsneeded.com/uploads/1/3/0/2/130289703/zavij.pdf
    • http://oakdalepoolservice.com/uploads/1/3/0/8/130813141/rulote.pdf
    • http://tastyformydoggie.com/uploads/1/3/0/7/130740212/c4cbe1e0.pdf
    • http://www.jh-healthcareconsulting.com/uploads/1/3/0/4/130476458/wuvidomapifiko.pdf
    • http://www.digitaltacklebox.ca/uploads/1/3/0/5/130551856/7448206.pdf
    • http://bv6g5.bpmtc.com/uploads/1/3/0/5/130551433/130551433.html#english+dictionary+in+hindi+pdf
    • http://fedorahosted.org/lohit
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License
    • https://savannah.gnu.org/projects/freefont/
    • http://www.gnu.org/licenses/
    • http://www.gnu.org/copyleft/gpl.html

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004074.bin
bb65e153df78154bfd14470754e87ba03df7715f8d52849d071c5334056f3476		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4074 16096 bytes
font_01_sfnt_off000054e9.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x54E9 1388 bytes
font_02_sfnt_off00005ea6.bin
df59ca3fe0278faa30e503433b67045bad719aff6c5dac5d94855554c58566a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5EA6 15088 bytes
font_03_sfnt_off000088eb.bin
bdb308becdc38138f98d57a308e1582ff789911202c588b575c7d9a706bfeff0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x88EB 8920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.