Malicious PDF — malware analysis report

Static analysis result for SHA-256 6754eb9d1b8efee4…

MALICIOUS

PDF

37.0 KB Authoring application: OpenOffice.org
MD5: 3b0a7a3d2dc0560abfbb36d26e374f75 SHA-1: 250ec344bacb1987bfaeab1b12191205256f4752 SHA-256: 6754eb9d1b8efee44d23d3f648817f5c8f900205bcfbf1d698e86efe824913d9
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was flagged by multiple heuristics, including a critical PDF_SEO_LINK_FARM rule and ClamAV detection as Pdf.Phishing.TtraffRobotInstall. The document body contains numerous embedded URLs, many of which appear to be part of a link farm designed to redirect users to other PDF files. This suggests a phishing or malicious content distribution scheme.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://patniemeyer.com/uploads/1/3/0/6/130639177/941e4790.pdf
    • http://connectmypast.com/uploads/1/3/0/3/130379740/2906547.pdf
    • http://11pluscolchester.com/uploads/1/3/0/3/130323425/vagobibev.pdf
    • http://partocica.com/uploads/1/3/0/3/130379227/07b5f92099a3ebc.pdf
    • http://myacexportfolio.com/uploads/1/3/0/7/130775880/nefajuledokaki-rutiwiwaxal-tevazo.pdf
    • http://communitiesdefendingdemocracy.us/uploads/1/3/0/6/130639916/lutefejiw.pdf
    • http://catching-nature.com/uploads/1/3/0/7/130776590/pukixibi.pdf
    • http://detailinggreensboro.com/uploads/1/3/0/7/130739312/7055327.pdf
    • http://solucionesacabados.com/uploads/1/3/0/6/130604589/lusopijetusuj.pdf
    • http://significadodeemojis.com/uploads/1/3/0/3/130379060/zijavupejemarivib.pdf
    • http://workerscompguide.com/uploads/1/3/0/8/130813539/4810474.pdf
    • http://shaydanielleesthetics.com/uploads/1/3/0/2/130291635/88935e18a67c0f.pdf
    • http://funafutimovie.com/uploads/1/3/0/7/130740082/e8a5e3ad10e5.pdf
    • http://myhypecheck.com/uploads/1/3/0/6/130605244/6c20b8021f67c.pdf
    • http://wtbest.net/uploads/1/3/0/8/130873994/8670954.pdf
    • http://girlydiamonds.com/uploads/1/3/0/6/130604488/4e628d768e.pdf
    • http://bergeronchryslercomplaints.com/uploads/1/3/0/4/130488993/pitepawizerib.pdf
    • http://ptchristy.com/uploads/1/3/0/6/130621220/lojom.pdf
    • http://citizenimmigrant.com/uploads/1/3/0/4/130491271/melotasosami-jojaki-lanin.pdf
    • http://thenestingspot.org/uploads/1/3/0/2/130287799/fulag-gonudevotuko-fetitenaterusut-dubinobalufulib.pdf
    • http://andreartwork.com/uploads/1/3/0/6/130603724/9510773.pdf
    • http://scottbrackenridgebuilders.co.nz/uploads/1/3/0/5/130545189/8375740b.pdf
    • http://elliottgoldberg.com/uploads/1/3/0/6/130621013/perujikirazeluk-wonesora.pdf
    • http://nupelicanparty.org/uploads/1/3/0/5/130589131/130589131.html#abiotic+and+biotic+factors+in+aquatic+ecosystem

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003132.bin
78ba47e15a5d4616d96199aadf8c55ccb967cd1bb5d7f6c431cd2da9f9a18b15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3132 6720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.