Malicious PDF — malware analysis report

Static analysis result for SHA-256 41e17502ef159c0f…

MALICIOUS

PDF

38.0 KB Authoring application: LibreOffice Draw
MD5: aa81c30fe82551df1d0731087a9144bf SHA-1: f2a993124fa478a99916824da9e28015a37aaaf5 SHA-256: 41e17502ef159c0f34b2d3aa0c2c1d5816ddaf21b21f746cc2bd0fc65781a64e
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, a technique commonly used for phishing or distributing further malware. The heuristic 'PDF_SEO_LINK_FARM' specifically identifies this behavior, indicating a link farm designed to redirect users. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports a malicious intent related to traffic redirection or phishing.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://avedaluzern.com/uploads/1/3/0/3/130323666/wanedenedalij_wajaf.pdf
    • http://alexiscoutu.com/uploads/1/3/0/6/130621584/8007010.pdf
    • http://mrpresscleaners.com/uploads/1/3/0/7/130739711/konenidekotanifem.pdf
    • http://fantasyalmanac.com/uploads/1/3/0/7/130739028/37688.pdf
    • http://tmsmllc.com/uploads/1/3/0/5/130551417/9b2e6207975b2ad.pdf
    • http://readerbeepost.us/uploads/1/3/0/7/130739140/a00ae.pdf
    • http://southerntreasuresgifts.com/uploads/1/3/0/4/130488213/wawigunexerumo.pdf
    • http://360pro.be/uploads/1/3/0/4/130476053/2ae0d431f.pdf
    • http://adkstrings.com/uploads/1/3/0/3/130323302/sepavugexefolap-vefesifakef-womufepukukaji.pdf
    • http://innovalprocess.net/uploads/1/3/0/6/130604874/kifefofonuseza_nelexibewe_sexupipa.pdf
    • http://helrae.com/uploads/1/3/0/8/130874470/4191018.pdf
    • http://sgtreasure.com/uploads/1/3/0/5/130589371/wagigofoweli-xiloje-xixujifapafole-folanelus.pdf
    • http://nghomeimprovment.com/uploads/1/3/0/3/130379770/kufelipokawab-funofipugi-jaximufugeguxe.pdf
    • http://www.taranakitimebanks.com/uploads/1/3/0/5/130588559/ziriwe_dugoko.pdf
    • http://www.kodiaksyle.com/uploads/1/3/0/5/130588698/kapufaxola-sudabawit-piroputagaru-wezitera.pdf
    • http://thediazobserver.com/uploads/1/3/0/3/130379506/9068539.pdf
    • http://destinationweddingsbigisland.com/uploads/1/3/0/5/130543148/6966926.pdf
    • http://fellowstech.us/uploads/1/3/0/6/130605229/6404482.pdf
    • http://nikkiheatsales.net/uploads/1/3/0/7/130738684/kuromuwezudoterasuve.pdf
    • http://ryan-mckenzie-se-1.rominastiebenphotography.com/uploads/1/3/0/7/130775598/130775598.html#askep+ibu+hamil+dengan+hiperemesis+gravidarum

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000373f.bin
68e0792d0bbdc66374cc05e51b1f3de14b3202a78e8dddbaf65f8cfa066e745f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x373F 7372 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.