Malicious PDF — malware analysis report

Static analysis result for SHA-256 2837f804d03a763c…

MALICIOUS

PDF

31.4 KB Authoring application: LibreOffice Draw
MD5: 2891018dfff2829e31acd7b88afd89a1 SHA-1: 4af90e21fadffb02b9449aa27e6d365de0f7e084 SHA-256: 2837f804d03a763cf860dc08e357e91aa18978bb9f9f416be8cf08d62277145b
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was flagged by multiple heuristics, including ClamAV and an ML classifier, as malicious. The primary indicator is the presence of a large 'SEO link farm' containing numerous embedded URLs pointing to external PDF files. This technique is commonly used to obscure the final malicious destination and distribute malware or phishing lures. No scripts were extracted from this sample, but the embedded URLs suggest a delivery mechanism for further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bryanblue.com/uploads/1/3/0/5/130543985/176ad51.pdf
    • http://presqueassezbien.com/uploads/1/3/0/5/130588394/mopuxijumatur_riroweta.pdf
    • http://naplesbesthairsalon.com/uploads/1/3/0/6/130603676/jupabu.pdf
    • http://naileddailycom.com/uploads/1/3/0/5/130590716/8582243.pdf
    • http://doctorheatherwood.com/uploads/1/3/0/4/130489241/befasirevi-lefevike-dapuraxojevade.pdf
    • http://christianambulancenetwork.com/uploads/1/3/0/4/130435757/93a49.pdf
    • http://morgangracejarrett.com/uploads/1/3/0/5/130590295/pasir.pdf
    • http://noeticpractices.com/uploads/1/3/0/6/130639407/nazujurobuloz.pdf
    • http://aliveyouthmebc.com/uploads/1/3/0/3/130323437/97dee71c7.pdf
    • http://muso101.com/uploads/1/3/0/6/130639753/momiwurub-xasat-xoduvekexezuw.pdf
    • http://feijoasarefabulous.com/uploads/1/3/0/2/130271137/130271137.html#separador+deaver+funcion
    • http://feijoasarefabulous.com/uploads/1/3/0/2/130271137/130271137.htm

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001273.bin
344b274ddc44d02209cde35e0a1fa4aa9840b2fec7e26e3e91bb6e4876abbf53		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1273 8480 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.