PDF malware analysis — malicious · 3fbb423a95b919c5

MALICIOUS

PDF

49.4 KB Authoring application: OpenOffice Draw

MD5: a4179facbc3e486fdb99d5406fa44600 SHA-1: 57579726e158b9a177fe6b087d3734fdd8154ed2 SHA-256: 3fbb423a95b919c5609fed9788504794372275a9bb60b4655334ba921fd8de6b

150 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files, a technique commonly used for SEO poisoning or to redirect users to malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The document body, though partially corrupted, mentions 'visa application' and 'cover letter template', suggesting a lure for users seeking such information.

Machine Learning

Nyx PDF Classifier malicious score 0.9990

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://chronicwellnessexpert.com/uploads/1/3/0/7/130775368/573894a52a85cbd.pdf
- http://naturalproducts.shop/uploads/1/3/0/3/130324350/7275498.pdf
- http://amandacake.com/uploads/1/3/0/5/130551949/leradotevep.pdf
- http://beastfriendz.com/uploads/1/3/0/5/130589198/nesud_variv_lirisujobe.pdf
- http://icantfocus.net/uploads/1/3/0/6/130620614/takazevofeluvo.pdf
- http://lapd.blue/uploads/1/3/0/4/130435520/wigofik-titudeze-dikijewazegoz.pdf
- http://newmarketcrossfit.com/uploads/1/3/0/2/130291491/31b8f1a0da7278.pdf
- http://www.gigispastrycafe.com/uploads/1/3/0/6/130604856/7cb068e44.pdf
- http://varanese.mobi/uploads/1/3/0/5/130539403/8221741.pdf
- http://buyerstreasure.com/uploads/1/3/0/4/130435672/ributegizubeme.pdf
- http://www.altomslankeprodukter.no/uploads/1/3/0/3/130313729/gaxon.pdf
- http://mkcpac.net/uploads/1/3/0/6/130639363/2013880.pdf
- http://hypahair.eu/uploads/1/3/0/6/130621354/losuda.pdf
- http://i-exp.net/uploads/1/3/0/2/130272928/jezukofisegupam.pdf
- http://carbonsoccer.com/uploads/1/3/0/9/130969308/6970803.pdf
- http://djmir.net/uploads/1/3/0/4/130435774/ferobiwamelif.pdf
- http://southislandloans.com/uploads/1/3/0/7/130739218/sidufemivedomawo.pdf
- http://notanotherpotcast.com/uploads/1/3/0/4/130488294/mapilag.pdf
- http://newrichmondoh.org/uploads/1/3/0/8/130813526/5c3455c56b79b4d.pdf
- http://jasonduty.com/uploads/1/3/0/2/130270974/zijegulakuvug-jemokazosizaki-papurunozebixip.pdf
- http://alanakolb.com/uploads/1/3/0/4/130490019/gexituva_domelopagipaket.pdf
- http://www.rareearthds.com.au/uploads/1/3/0/4/130476024/xidiwavigox.pdf
- http://182491147661785381.com/uploads/1/3/0/5/130588864/vepupatenimamen.pdf
- http://bayviewblast.com/uploads/1/3/0/4/130436426/narezorotekekerabuni.pdf
- http://blackhawbuilders.com/uploads/1/3/0/6/130604654/130604654.html#cover+letter+template+for+visa+application

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000044e8.bin` `779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x44E8	16036 bytes
`font_01_sfnt_off00005c2e.bin` `0a5dc933ca55838a17e7d405547678f53b8494a4589daa9afc9c5cd1d8b6e410`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x5C2E	8616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.