Malicious PDF — malware analysis report

Static analysis result for SHA-256 303b34f1e4cc38f1…

MALICIOUS

PDF

98.5 KB Authoring application: LibreOffice
MD5: a36a44333455701a8ee5e41d92150598 SHA-1: 998d6ddfa93ad7fdc07597fabd0a2cca897d1453 SHA-256: 303b34f1e4cc38f1fd572f98f4b9614abaa4eb943555b9333a21f639f1ab845c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for phishing or malware. ClamAV identified the file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', further supporting a phishing or malicious intent. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery or execution methods.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9996

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.budapestacousticband.hu/uploads/1/3/0/7/130739895/riwamuzosedize.pdf
    • http://mx.ea-abc.org/uploads/1/3/0/3/130324278/rezak.pdf
    • http://bigboyrobo.com/uploads/1/3/0/2/130289515/1d0d94d.pdf
    • http://premierbeachfl.com/uploads/1/3/0/3/130323461/nowevebofukepufebu.pdf
    • http://motionfuels-arkansas.com/uploads/1/3/0/5/130551651/lijapanodegipid-vewezetur.pdf
    • http://mail.dustysprinklers.com/uploads/1/3/0/8/130874136/3677546.pdf
    • http://christophmeyer-weller.com/uploads/1/3/0/9/130969366/f8ebcaff.pdf
    • http://mountainandwaterstudio.com/uploads/1/3/0/8/130813369/3347950.pdf
    • http://hostmaster.immaginepca.it/uploads/1/3/0/6/130639438/0222a5c6a2.pdf
    • http://goldheart.us/uploads/1/3/0/6/130640172/gipilemuv.pdf
    • http://silvabuildings.com/uploads/1/3/0/6/130604147/menikunavovip.pdf
    • http://themossgroupllc.org/uploads/1/3/0/5/130546977/xuguwovesuvoru.pdf
    • http://iccaroo.org/uploads/1/3/0/4/130476322/6039561.pdf
    • http://www.jsallnaturals.com/uploads/1/3/0/5/130588980/wofofedamumuxum.pdf
    • http://seaviewpainting.com.au/uploads/1/3/0/4/130490665/2884866.pdf
    • http://luckofthedraw.fun/uploads/1/3/0/5/130589420/6877127.pdf
    • http://mx69.farmfreshsoaps.com/uploads/1/3/0/6/130605240/suwirifebomilupokiwu.pdf
    • http://looe-festival-of-the-sea.com/uploads/1/3/0/6/130639661/5642532.pdf
    • http://natashafine.com/uploads/1/3/0/4/130436390/rozutugogo.pdf
    • http://obediencejourney.com/uploads/1/3/0/5/130550838/xotolonokilupu.pdf
    • http://markkraemer.net/uploads/1/3/0/7/130776405/zokodekodoguzun-nimagum-gexokut-weven.pdf
    • http://afforablehomesociety.com/uploads/1/3/0/6/130639400/zimelavur.pdf
    • http://andresbeatstore.com/uploads/1/3/0/2/130287881/35bb89a8.pdf
    • http://www.mikeisthekey.com/uploads/1/3/0/9/130969725/130969725.html#logic+gates+explained+with+boolean+algebra

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005ebb.bin
085d66cbde92bc2546a708dd5f060297de955063814a1c7bdc14ba48889de09c
pdf-font-stream PDF embedded font (sfnt) at offset 0x5EBB 3712 bytes
font_01_sfnt_off00006b2c.bin
4cad911d68e2816258fee8e3921ab3f90b60e145840eb4cd12b6829e7a654d5b
pdf-font-stream PDF embedded font (sfnt) at offset 0x6B2C 16560 bytes
font_02_sfnt_off00008535.bin
a402768d93f1c16b7186b80cad678bb6030dd93fe7304b9dd3d3a78931858c1f
pdf-font-stream PDF embedded font (sfnt) at offset 0x8535 9740 bytes