Malicious PDF — malware analysis report

Static analysis result for SHA-256 5a5f80065ad79fce…

MALICIOUS

PDF

63.4 KB Authoring application: OpenOffice.org
MD5: 47468df8445de0e6e6f1b1e41ee51a76 SHA-1: 4b0717b9b0d7525e40c922a67600967cf2daeac0 SHA-256: 5a5f80065ad79fce8e4dda3dee39079b1b0a8c7bae7a1c104bb6481603aab6cb
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.007 JavaScript

The PDF contains a large number of embedded external links, many of which point to other PDF files, suggesting a link farm designed to distribute malicious content. ClamAV detection and ML classification confirm its malicious nature. The presence of a download button lure further supports the phishing attempt.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9990

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://toptencabo.com/uploads/1/3/0/6/130640109/68e49ea50b32d30.pdf
    • http://nigelcrossan.com/uploads/1/3/0/6/130620776/5851099.pdf
    • https://birorajose.weebly.com/uploads/1/3/0/2/130274305/4c5757c.pdf
    • http://moldyold.com/uploads/1/3/0/6/130621794/tozoti-zovikokijip.pdf
    • http://keyconnect.net/uploads/1/3/0/5/130550666/sarasavutur_kilan_wodalasanatux_mojulibavajudo.pdf
    • http://utile-it.com/uploads/1/3/0/6/130639855/fe2f9320c1e29.pdf
    • http://moodlabnewlife.nl/uploads/1/3/0/5/130540397/130540397.html#design+portfolio+template+free

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001336.bin
4a1b6de242f1dbc59f5aa908d0a68217f24ead929bff41ecefd43578b14aa5ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1336 8444 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.