Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e2c11a0b39633bb…

MALICIOUS

PDF

43.2 KB Authoring application: OpenOffice.org
MD5: d93dde1d57fae94b730d2216da9db316 SHA-1: 96bf837679639c25c550451cec73b684f36be88f SHA-256: 4e2c11a0b39633bb68b1c48f15d7c5b1efe94f768344afe980bd37b2696641ed
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF was flagged by multiple heuristics, including a critical finding for a link farm and ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body, though malformed, contains text related to 'Mental retardation definition types and characteristics pdf', suggesting a lure. The primary attack pattern involves directing users to a large number of external PDF files hosted on various domains, likely for SEO spam or to distribute further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://miningwithfriends.net/uploads/1/3/0/5/130551405/disesajowudag_kukijubi_wizoxe_wulurifibur.pdf
    • http://callmyhearthome.com/uploads/1/3/0/6/130604671/kobogowelevuxato.pdf
    • http://alicemanganphd.com/uploads/1/3/0/5/130541661/renaresazire.pdf
    • http://moonlighthandcraft.com/uploads/1/3/0/6/130604977/revewilezegugefitajo.pdf
    • http://thehappylifeacademy.com/uploads/1/3/0/5/130543453/bomolemiteb.pdf
    • http://catching-nature.com/uploads/1/3/0/2/130288557/063ae374420900.pdf
    • http://limobavanu.zapad-auto.com/uploads/2020/01/28/11fe74.pdf
    • http://ankezimmermann.ca/uploads/1/3/0/6/130640027/130640027.html#mental+retardation+definition+types+and+characteristics+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011d2.bin
3ef4dba0fd21185f94f42c3f3bf12acb0f06189e9bbbe89d1f476a82d4c0d3fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D2 8636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.