Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a24c0dd56146c92…

MALICIOUS

PDF

36.7 KB Authoring application: OpenOffice.org
MD5: 182a63ab95f4680591242066e1083d85 SHA-1: 8b9d049733a45bf4ac5d7c789e8c890cbf8254a2 SHA-256: 4a24c0dd56146c928b0c775e289a905423fac0c8f8d5be635dff566c9522f647
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file is detected as malicious by ML classifiers and ClamAV, specifically identified as a phishing/traffic robot installer. The document body is disguised as a resignation letter template, but it contains a large number of embedded URLs pointing to other PDF files. These URLs form a link farm, indicating a likely attempt to distribute further malicious content or redirect users to phishing sites.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://petermcdonnellwriter.com/uploads/1/3/0/2/130289166/ratijigu.pdf
    • http://terpenebulk.com/uploads/1/3/0/2/130289346/gegofijomoz-konixa-bevivabime.pdf
    • http://binnachtees.com/uploads/1/3/0/4/130475992/kopitobuj_vitilo_sutejivewudi_perebifagipeso.pdf
    • http://redwaters.co.uk/uploads/1/3/0/6/130620537/7961967.pdf
    • http://powdercoatprosnd.com/uploads/1/3/0/5/130544243/nipudiguxeninuk-vikofozelamulal-burivinowada-zikulek.pdf
    • http://funandsun.org/uploads/1/3/0/2/130271094/9466735.pdf
    • http://mrpsmathclass.com/uploads/1/3/0/6/130621178/suxubajopatarimi.pdf
    • http://defense-elec-corp.com/uploads/1/3/0/6/130621892/selakilalirelobukud.pdf
    • http://ki-logistics.com/uploads/1/3/0/6/130621293/vilosupunopegux-jikax-forupivanozof-webos.pdf
    • http://mishticakesandparties.com/uploads/1/3/0/2/130289734/98d3190b053.pdf
    • http://sacredstarastrology.com/uploads/1/3/0/6/130621457/8fa97d.pdf
    • http://acouturelife.com/uploads/1/3/0/5/130590208/130590208.html#resignation+letter+sample+with+waiver+of+notice+period

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001388.bin
579d444294571a2241945685adca661414b4f44cc918eb1ccb878a52712cd424		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1388 8280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.