Malicious PDF — malware analysis report

Static analysis result for SHA-256 1bd139110e4f4f85…

MALICIOUS

PDF

39.8 KB Authoring application: LibreOffice First seen: 2020-09-07
MD5: f7264755f37b14023f50af0b648e3edf SHA-1: 5116c08885d056b55f53d1ef73ada80f0c7a4b62 SHA-256: 1bd139110e4f4f85b81b3613f7cd1902aa02aaaeaf7f105c7834daaac99e9406
152 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, as indicated by the PDF_SEO_LINK_FARM heuristic. This suggests a link farm or a distribution mechanism for further malicious content. The ML classifier and ClamAV detection strongly indicate malicious intent, specifically identified as Pdf.Phishing.TtraffRobotInstall-7605656-0. No scripts were extracted from this sample, limiting the ability to determine specific execution behaviors.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ncexchangeclub.com/uploads/1/3/0/6/130620981/b6f726.pdf In PDF document text
    • http://earthspiritpath.net/uploads/1/3/0/2/130288554/likemimoworipo.pdfIn PDF document text
    • http://mikesrefinishing.com/uploads/1/3/0/4/130489363/2545225.pdfIn PDF document text
    • http://alumcanyonediting.org/uploads/1/3/0/4/130435715/3789063.pdfIn PDF document text
    • http://www.st-clair-county-fair.com/uploads/1/3/0/5/130539437/6318792.pdfIn PDF document text
    • http://mal-test.com/uploads/1/3/0/7/130776131/2c50c7b9.pdfIn PDF document text
    • http://vceesolutions.com/uploads/1/3/0/7/130775715/7791262.pdfIn PDF document text
    • http://vc3hk.bpmtc.com/uploads/1/3/0/2/130289247/71e6b97c2.pdfIn PDF document text
    • http://organicolosangeles.com/uploads/1/3/0/6/130639071/03b918.pdfIn PDF document text
    • http://baytulmamoor.org/uploads/1/3/0/3/130324340/d087e1b2.pdfIn PDF document text
    • http://openheavensglobal.org/uploads/1/3/0/7/130739062/wemudosumu_gevumi.pdfIn PDF document text
    • http://tierisch-tragbar.de/uploads/1/3/0/7/130739607/lamolubojomokog.pdfIn PDF document text
    • http://jingcaijiangjin.br3h.com/uploads/1/3/0/4/130488227/130488227.html#democracy+vs+republic+vs+communism+vs+socialismIn PDF document text
🗂 Part of campaign: mikesrefinishing.com 3 samples

Related samples 2

Ranked by shared artifacts, heuristics, extracted URLs, CVEs, and signatures.

Full JSON: related samples API

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000441f.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x441F 7980 bytes
SHA-256: d4832b97382be0c016c9b1ddc863bf67a6cdc1c0defb9f3cebc37dd9cab543d7

Open this report in the interactive analyzer, or submit your own file for analysis.