Malicious PDF — malware analysis report

Static analysis result for SHA-256 1684b7ef72d9ffb4…

MALICIOUS

PDF

42.2 KB Authoring application: OpenOffice Draw
MD5: 55421cf7be0972244ae289e2999b580d SHA-1: de1f16ed833c149985cdc0f520a5d50612e8e832 SHA-256: 1684b7ef72d9ffb4f0958f6622ccae2499c5d4254ad4dbc080ee815c6eece34a
192 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains numerous links to external PDF files, a technique often used to distribute malware or conduct phishing attacks. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The embedded URLs are likely part of a link farm designed to redirect users to malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • PDF link to algorithmically-generated URL high PDF_RANDOM_URL_LINK
    PDF contains a clickable HTTP(S) link whose host looks algorithmically generated (pronounceable-random labels) and whose path/query carries a long high-entropy token. This is the randomized-redirector pattern of malspam phishing lures — the visible document is only a prompt — not a PDF parser vulnerability.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://puppyparentpro.com/uploads/1/3/0/6/130620959/3e6eadf0.pdf
    • http://theotherevilsister.com/uploads/1/3/0/5/130543280/2378031.pdf
    • http://brasspearlsandpatinablog.com/uploads/1/3/0/8/130813030/3c0bbcdcd020.pdf
    • http://mail.lynndollin.com/uploads/1/3/0/4/130489157/lorixi_fenelekuvutipuz.pdf
    • http://1050catalpa.com/uploads/1/3/0/5/130588784/fugogedolawivazi.pdf
    • http://knowledgeoftheword.net/uploads/1/3/0/8/130814076/pelejefaxen_fovujomaxedifaf_jivirebipaxen_sizixelipo.pdf
    • http://juandou.net/uploads/1/3/0/7/130739475/2884490.pdf
    • http://aprendizajeactivobrumiel.com/uploads/1/3/0/5/130588165/zegeriwut_vubuzegex_fazazisusejilo.pdf
    • http://evosys.services/uploads/1/3/0/7/130776573/siziv.pdf
    • http://themoc.shop/uploads/1/3/0/7/130738971/josenokakozonami.pdf
    • http://caninesareforever.com/uploads/1/3/0/2/130270796/1cbc3817.pdf
    • http://arpi.ca/uploads/1/3/0/2/130272428/6080554.pdf
    • http://saritelpner.com/uploads/1/3/0/5/130550752/9809293.pdf
    • http://buyelectricmotorbikes.com/uploads/1/3/0/7/130738706/09f4fb.pdf
    • http://independentadultcarehomeassociation.com/uploads/1/3/0/5/130547215/dusomoxelirujit.pdf
    • http://miftahinvestmentgroup.com/uploads/1/3/0/7/130775805/repadomutisotalut.pdf
    • http://www.joelmalima.com/uploads/1/3/0/4/130488141/ef253f5d97a4.pdf
    • http://joestoptobottomhomeinspections.com/uploads/1/3/0/6/130621432/janubute.pdf
    • http://www.soundcohousing.com/uploads/1/3/0/4/130435532/753e25aea.pdf
    • http://imagecenterspa.com/uploads/1/3/0/2/130270990/5770017.pdf
    • http://catholicmix.com/uploads/1/3/0/6/130621353/9307956.pdf
    • http://nataliemangalindandesign.com/uploads/1/3/0/6/130639883/demalabiton_wideneroxinibos_wegaxilipo.pdf
    • http://adrenal14.pleasingfood.com/uploads/1/3/0/6/130604151/130604151.html#cisco+meraki+mr42-hw+access+point

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000041ed.bin
44039b223ed4e97cad7f7ac44f253bf7fd476b20af3056ab578da8e07264b1ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x41ED 8568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.