Malicious PDF — malware analysis report

Static analysis result for SHA-256 181a708d4c03d743…

MALICIOUS

PDF

41.1 KB Authoring application: LibreOffice
MD5: cb8a60072ff9ee6600c54cb22793f126 SHA-1: c7f9e01df3236d176216f5b91d6e41b628192eea SHA-256: 181a708d4c03d743c9283305b1102a9fed252264e925215beeded55eaf4ead9f
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute further malicious content. ClamAV detected this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a machine learning classifier also flagged it as malicious. The embedded URLs are the primary indicators of compromise.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jacksonholeskipackages.net/uploads/1/3/0/4/130483660/e956fa8f9.pdf
    • http://dippedarmor.com/uploads/1/3/0/2/130272360/wefimu.pdf
    • http://afriwendythread.com/uploads/1/3/0/2/130273617/4530693.pdf
    • http://geeksmind.com/uploads/1/3/0/4/130483653/3520910.pdf
    • http://michaelfilipelli.com/uploads/1/3/0/3/130379675/sajugururixir.pdf
    • http://everydayolympian.com/uploads/1/3/0/8/130873717/bb18fe938306ae.pdf
    • http://www.fourlittleoneshilo.com/uploads/1/3/0/5/130550803/8731d485159141.pdf
    • http://minagcapital.com/uploads/1/3/0/2/130270971/basaluko.pdf
    • http://www.biwiztechnologies.co.uk/uploads/1/3/0/7/130739802/7604b6cd.pdf
    • http://psychologyflow.com/uploads/1/3/0/7/130775176/rawate.pdf
    • http://istemeducation.net/uploads/1/3/0/4/130490115/judoputuvufosafowe.pdf
    • http://greerblair.com/uploads/1/3/0/5/130588772/vapomafilokevo-fapudovelekuk-voxotixesi.pdf
    • http://novelistsandrahall.com/uploads/1/3/0/3/130379121/3d248e9fd488.pdf
    • http://stockfreebie.com/uploads/1/3/0/7/130775791/fonakax.pdf
    • http://goldpriceweb.com/uploads/1/3/0/2/130273752/pavogufunuwu.pdf
    • http://victoryit.org/uploads/1/3/0/7/130775854/9404661.pdf
    • http://www.theartofbelovingness.com/uploads/1/3/0/4/130476145/4444665.pdf
    • http://mail.tweetsbyandre.com/uploads/1/3/0/6/130620520/vugisom_gejabu_soxofebupok.pdf
    • http://startapper.com/uploads/1/3/0/2/130272403/tunadojawam.pdf
    • http://www.stephancappon.com/uploads/1/3/0/6/130621995/3017608.pdf
    • http://belquiszahir.com/uploads/1/3/0/6/130604653/bowoxo.pdf
    • http://spirituallyyou.store/uploads/1/3/0/5/130589010/2922117.pdf
    • http://stmartinsquare.com/uploads/1/3/0/6/130620854/3670190.pdf
    • http://responsdirect.no/uploads/1/3/0/5/130588639/3904302.pdf
    • http://adsl-63-204-18-45.benefitplans.org/uploads/1/3/0/8/130814382/130814382.html#file+pdf+gak+bisa+di+print

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003c76.bin
72b330493da4f27a88a2b66596f1d24807e42bc115dbd3cab39e316f0eb4983e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3C76 8408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.