Malicious PDF — malware analysis report

Static analysis result for SHA-256 39c76dd2166c5443…

MALICIOUS

PDF

42.5 KB Authoring application: OpenOffice Draw
MD5: c1d97256449281af03826819cdfa3ec8 SHA-1: 092424f72384afa5e9d333ed4c47629393fbfdf3 SHA-256: 39c76dd2166c5443f74b8d436a5a1e45242a1b41f22fda1737e18b71d583281b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic, which strongly suggests a phishing or SEO poisoning attack. The ClamAV detection and ML classifier further confirm its malicious nature. No scripts were extracted, and the document body was heavily obfuscated and truncated, preventing a more detailed analysis of the lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://amar71.com/uploads/1/3/0/5/130550711/vifagubo.pdf
    • http://anticulturalism.com/uploads/1/3/0/6/130620482/virak.pdf
    • http://breadandboots.com/uploads/1/3/0/6/130604803/danurubopeze_valedi_vivida.pdf
    • http://connhagiau.com/uploads/1/3/0/8/130873794/fifimujevoj.pdf
    • http://aiofyou.org/uploads/1/3/0/5/130539458/0d34f3ed.pdf
    • http://www.christianlouboutinshoes22.dadgifts.us/uploads/1/3/0/8/130813577/9424476.pdf
    • http://festivalimperial.com/uploads/1/3/0/2/130288448/zinufadoxixiliv.pdf
    • http://naturalkinksinthecreek.com/uploads/1/3/0/3/130379115/sodipizowozege_buxexaz_nepazovaven.pdf
    • http://570dj.com/uploads/1/3/0/2/130287799/07a2f4c.pdf
    • http://msftnerd.com/uploads/1/3/0/4/130476573/4540531.pdf
    • http://nwm4.club/uploads/1/3/0/3/130379232/vigegosezo-tusugikaxipijaf-dubijuranevi-bafus.pdf
    • http://ixisinc.com/uploads/1/3/0/4/130476503/3164843.pdf
    • http://basementcityproductions.com/uploads/1/3/0/3/130313391/bifobusunanaruf.pdf
    • http://angelannette.com/uploads/1/3/0/3/130323754/vonusefimejaz.pdf
    • http://caravanofglam.com/uploads/1/3/0/5/130544091/4185525.pdf
    • http://claypancreas.com/uploads/1/3/0/3/130379248/0e651b.pdf
    • http://nutrition-doctor.co.uk/uploads/1/3/0/5/130588588/7577923.pdf
    • http://jonathanfine.net/uploads/1/3/0/2/130288465/suduwegafok_jawufaruto.pdf
    • http://nlrtsa.com/uploads/1/3/0/7/130775704/vogim.pdf
    • http://texasstocklawyers.com/uploads/1/3/0/2/130288397/dejiviki.pdf
    • http://eunsookim.com/uploads/1/3/0/6/130639426/e4b79bf2.pdf
    • http://74-123-72-38.mgwnet.com/uploads/1/3/0/7/130739530/130739530.html#flash+pulmonary+edema+emcrit
    • http://breadandboots.com/uploads/1/3/0

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000437b.bin
657624794840a28ac4f8586ac27f05bc5370356db70e340447059941876d789a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x437B 8896 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.