Malicious PDF — malware analysis report

Static analysis result for SHA-256 635227ade4ba3e6e…

MALICIOUS

PDF

39.3 KB Authoring application: LibreOffice Draw
MD5: 8588cf30d83942dfa7df318b1cebaa5d SHA-1: c4ee56dc9f39f090db0e17a0904d0406e6d296fc SHA-256: 635227ade4ba3e6e2797349492d34d8c11cf3997434f95765fa8f5f7329ee1c7
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a mass external link farm with 31 URLs, indicating a likely attempt to distribute malicious content or phish users. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly suggest malicious intent. Although no scripts were extracted, the presence of a 'download' button lure and numerous external links points to a downloader or redirector pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://headsuplife.com/uploads/1/3/0/7/130775876/053ffcd9caf5ba.pdf
    • http://rubyhenschke.com/uploads/1/3/0/3/130313809/sireman-jibezenodamaga-dabelezedeba.pdf
    • http://conquercoffee.com/uploads/1/3/0/5/130588731/xadebesavakalorixin.pdf
    • http://www.juniorroadnationals.com/uploads/1/3/0/6/130604631/vudiwufu.pdf
    • http://simixlaundry.com/uploads/1/3/0/8/130813804/9d52cf1c.pdf
    • http://bizniznews.com/uploads/1/3/0/5/130540046/jumoposinilek_dekolan.pdf
    • http://lifeinprinceton.com/uploads/1/3/0/6/130639549/55bf09b99.pdf
    • http://cecilyeiferle.com/uploads/1/3/0/7/130775763/kikuwopekovuxut.pdf
    • http://jeanniehouchins.com/uploads/1/3/0/7/130775786/vurafejopo.pdf
    • http://dellenergyconsulting.com/uploads/1/3/0/3/130313638/6d6b85ccdbec0.pdf
    • http://oacmedicalspa.ca/uploads/1/3/0/6/130620412/lakif_denez_tawezinozaderox_kidilarorizofus.pdf
    • http://osiedlepostepu.pl/uploads/1/3/0/2/130288359/8216206.pdf
    • http://newmapsoftheoldwest.com/uploads/1/3/0/6/130620811/6121561.pdf
    • http://drpatty.net/uploads/1/3/0/5/130590296/tepebu_gapiwirozero_vewutuxezavoje.pdf
    • http://ds4all.tech/uploads/1/3/0/4/130490602/jupadibanizeg.pdf
    • http://hostmaster.gdub.tv/uploads/1/3/0/2/130289243/3887022.pdf
    • http://changemakercommunityservices.org/uploads/1/3/0/3/130380084/88c51da7b.pdf
    • http://oohlava.com/uploads/1/3/0/8/130814644/8acddc604e.pdf
    • http://www.commongracetherapy.com/uploads/1/3/0/6/130621684/591f40536769.pdf
    • http://anchoredhomedesigns.com/uploads/1/3/0/2/130270831/wuvizapimodujudupobo.pdf
    • http://mta-sts.mx.ruleyscanecorsos.com/uploads/1/3/0/5/130551967/4592217.pdf
    • http://nsuelite.gammaxiques.org/uploads/1/3/0/9/130969435/130969435.html#ap+dsc+school+assistant+hall+tickets+2018

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000379c.bin
c9f2b6e3329ce0b4eb67121329972dac82592f346b3d2f369610b835b924fbb0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x379C 8284 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.