Malicious PDF — malware analysis report

Static analysis result for SHA-256 40659d967619ecb4…

MALICIOUS

PDF

38.7 KB Authoring application: LibreOffice Draw
MD5: 39467f68a83a2303a693d126508206cb SHA-1: 9e8a386206be5382feb948e52e1886de690cd0b5 SHA-256: 40659d967619ecb469ef209ef05a88b02cf36f6a496251aebb2ac83aa73c09f9
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection for Pdf.Phishing.TtraffRobotInstall-7605656-0. The ML classifier also assigned a high probability of maliciousness. The document contains a large number of embedded URLs pointing to external PDF files, suggesting a phishing or content distribution scheme. The document body itself appears to be corrupted or contains non-readable characters, but the presence of numerous links is the primary indicator of malicious intent.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://montalvinmanor.org/uploads/1/3/0/2/130289754/2a18a4e9174b40.pdf
    • http://radiomaingo.com/uploads/1/3/0/7/130776564/numuvuf.pdf
    • http://erguvanmobilya.com/uploads/1/3/0/6/130639743/8780461.pdf
    • http://asenamott.com/uploads/1/3/0/5/130588625/7901064.pdf
    • http://ex-statics.com/uploads/1/3/0/8/130873987/gaduzugi.pdf
    • http://www.househunterscoloradosprings.com/uploads/1/3/0/5/130551067/xumewevema-nofuku-jalofonujo.pdf
    • http://explanationspecialist.com/uploads/1/3/0/5/130588546/zelokut-telejen.pdf
    • http://enderman.org/uploads/1/3/0/3/130323360/wusid_guvenukinubara.pdf
    • http://eureka.rocks/uploads/1/3/0/9/130969027/wasunekafimuwej.pdf
    • http://woodenspooncuisine.com/uploads/1/3/0/4/130436513/tupapev.pdf
    • http://aukstamford.com/uploads/1/3/0/2/130289493/7384957.pdf
    • http://dmgatl.com/uploads/1/3/0/3/130313612/latogofefi-tasosusebex-suxokufesuruvar.pdf
    • http://holidayhoarders.com/uploads/1/3/0/6/130639703/a7efe.pdf
    • http://carpetcleaningwinston.com/uploads/1/3/0/7/130775817/b52310f1f134.pdf
    • http://muziekcursusonline.com/uploads/1/3/0/7/130776002/62697e3fed377a.pdf
    • http://tcgplanet.com/uploads/1/3/0/6/130620551/vugidixufu.pdf
    • http://across-science-art-creation-formation.com/uploads/1/3/0/5/130588754/rujujapurogimi.pdf
    • http://www.trainevryday.com/uploads/1/3/0/2/130272511/suvivememepixi.pdf
    • http://behappybyyuli.com/uploads/1/3/0/3/130313190/fawupoma.pdf
    • http://www.dilsavergroup.com/uploads/1/3/0/8/130874573/jomosuzumipepowuzo.pdf
    • http://annettelscott.com/uploads/1/3/0/5/130552016/86cccaa.pdf
    • http://cpanel.rodhillportraits.com/uploads/1/3/0/5/130588505/130588505.html#online+carnatic+music+learning+classes
    • http://muziekcursusonline.com/uploads/1/3/0/7

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003761.bin
ccc90b4e235102a64bf853f900e1f4fb95916a0ac0957d13e548179f948a246b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3761 7652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.