Malicious PDF — malware analysis report

Static analysis result for SHA-256 16e35318c69c2acc…

MALICIOUS

PDF

34.8 KB Authoring application: LibreOffice
MD5: 102b074f3243790809630682b8526de8 SHA-1: 699189f9f414fb6f8a57b780fcc92708e3a0c1bd SHA-256: 16e35318c69c2acc506d7692b69798db14e9f530685eba8af4ef4fded6da50a4
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

This PDF file is identified as malicious by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection for 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body and embedded URLs suggest a phishing lure, attempting to trick users into downloading further malicious content disguised as legitimate files. The presence of numerous external PDF links indicates a link farm designed to distribute malware or facilitate further phishing attempts.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mta-sts.mail.djhinton.com/uploads/1/3/0/4/130477663/5740c1aaf093.pdf
    • http://lifetrim.net/uploads/1/3/0/6/130639634/gedenot.pdf
    • http://mitsubishipricelist.com/uploads/1/3/0/2/130291689/86aafcf3cc.pdf
    • http://kimbery-barrett.com/uploads/1/3/0/5/130551319/lexebunuwobi.pdf
    • http://mkollaras.com/uploads/1/3/0/4/130483804/2e4e3bc.pdf
    • http://themovelab.com/uploads/1/3/0/6/130639653/nagusikorovi.pdf
    • http://www.grovenamsterdam.com/uploads/1/3/0/5/130543598/15d0c53ca2df705.pdf
    • http://doem.work/uploads/1/3/0/9/130968992/6862660.pdf
    • http://breckgear.com/uploads/1/3/0/6/130604558/vowefebofafipigof.pdf
    • http://amicoffeecompany.com/uploads/1/3/0/4/130488220/lekigole.pdf
    • http://www.yourdailyvibes.us/uploads/1/3/0/6/130604536/kaxutibolexixefoze.pdf
    • http://kyflowernseed.com/uploads/1/3/0/3/130379287/130379287.html#blender+3d+architecture+buildings+and+scenery+pdf+download

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003094.bin
36587832b0368437f116c2a55aa27611d0c08b1b3ef614193607057edf1fcf12		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3094 8060 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.