Malicious PDF — malware analysis report

Static analysis result for SHA-256 399a02c8bbb0d9c4…

MALICIOUS

PDF

32.6 KB Authoring application: LibreOffice Draw
MD5: ee9b9c7c5cbb3c3542f77aa23c7f3696 SHA-1: b9b9036bfb8490c2950a72a401444e616e829590 SHA-256: 399a02c8bbb0d9c42f0a9e57187a046fab9d81ecc2e47ec54f584e9d74b91f31
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO poisoning or to redirect users to malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies the mass linking to external PDFs, with 'ryanlimagames.com' being the dominant host for these links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ryanlimagames.com/uploads/1/3/0/2/130289272/36c6252.pdf
    • http://maltaglasscreations.com/uploads/1/3/0/7/130740538/barawi.pdf
    • http://mycthomson.com/uploads/1/3/0/5/130539102/gumipulisigejab.pdf
    • http://aurorasolar.org/uploads/1/3/0/2/130289359/1116902.pdf
    • http://lonepress.net/uploads/1/3/0/4/130436272/95fe68f8f.pdf
    • http://brisbanefloatandmassage.com.au/uploads/1/3/0/7/130775215/4199373.pdf
    • http://eddie-ieong.com/uploads/1/3/0/4/130435962/3517773.pdf
    • http://lifeuncorkd.com/uploads/1/3/0/6/130605161/bifisugerijebe.pdf
    • http://firewallyourwallet.com/uploads/1/3/0/6/130604150/lagetetiriniken_jelevofu_wuxipexufola_robitomad.pdf
    • http://jefflinsenmaier.com/uploads/1/3/0/6/130621484/zupenav-zegupukurewum.pdf
    • http://incartix.net/uploads/1/3/0/5/130538950/5414083.pdf
    • http://newlifefitz.org/uploads/1/3/0/7/130739490/3133548.pdf
    • http://skirts-by-elle.com/uploads/1/3/0/6/130622116/jagitejik.pdf
    • http://allnurserd.com/uploads/1/3/0/3/130323210/b18a59.pdf
    • http://www.stressfreemove.net/uploads/1/3/0/8/130873718/gatabo_sekajogozela.pdf
    • http://45t34.slpny.com/uploads/1/3/0/3/130323532/130323532.html#demographic+transition+model+stages+ppt
    • http://www.stressfreemove.net/uploads/1/3/0/8/130873718/gatabo_sekajogozela

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000263a.bin
43e24bfd88efccd8adee393603994153eb53e2991b811512731e1effa9d4e8bf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x263A 7340 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.