Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e8acd9947b92a2c…

MALICIOUS

PDF

34.7 KB Authoring application: LibreOffice Draw
MD5: b2a54a2461a1e741673d4e2d4d7701bc SHA-1: 34df7d83ad50b1e1bdda3530727c64313170b505 SHA-256: 4e8acd9947b92a2c111d63016f02d491e2e0e1a58b19070e10641a8c1d6287fa
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The document body, though heavily obfuscated, contains URLs that are part of this link farm, suggesting the primary purpose is to redirect users to potentially harmful content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mycpmc.com/uploads/1/3/0/6/130640191/vixelojufarad-gevijupokup-dedutumoxer-kunawapob.pdf
    • http://deliberatehealthcreation.com/uploads/1/3/0/2/130271047/c7a49cc34.pdf
    • http://yogaindradevi.com/uploads/1/3/0/6/130639755/fupimamovif-wilimeretukopob-sosojamef-magaxufofujawet.pdf
    • http://snapshotsofwisdom.com/uploads/1/3/0/6/130621451/kijetukeripezadol.pdf
    • http://summitcityguitartraining.com/uploads/1/3/0/5/130590665/povimokebozari_zefet.pdf
    • http://badbear.ca/uploads/1/3/0/6/130639580/niriwir.pdf
    • http://digitalmortgageloan.co/uploads/1/3/0/5/130551153/1451166.pdf
    • http://namdalseidmusikklag.no/uploads/1/3/0/5/130551661/5167905.pdf
    • http://mmafanvote.com/uploads/1/3/0/3/130379398/fd1a5.pdf
    • http://hrtechpro.org/uploads/1/3/0/6/130604621/tekel-noxakav-benuba.pdf
    • http://03862strong.com/uploads/1/3/0/6/130620951/6825633.pdf
    • http://baysideschoolrefusalclinic.com/uploads/1/3/0/2/130272587/8392063.pdf
    • http://rochecenter.org/uploads/1/3/0/4/130490019/130490019.html#convert+pdf+to+excel+adobe+pro

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001390.bin
163531e23122223c5fb33ab2e0266cc484e3ef5c45cdc681f89b35d1b1f2e7b3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1390 8344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.