Malicious PDF — malware analysis report

Static analysis result for SHA-256 6b7e898757c6d9da…

MALICIOUS

PDF

35.4 KB Authoring application: OpenOffice Draw
MD5: 620b1cb5038ddfa3bcffec523962702d SHA-1: 58d54de3ba3eecc961859f7b47a6d3866d400e58 SHA-256: 6b7e898757c6d9da3278b231d252bafc54a4c5ee5f427ca202b7c211e80ad1e6
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded links to external PDF files, a technique often used in SEO poisoning or phishing campaigns to direct users to malicious content. ClamAV detected this as Pdf.Phishing.TtraffRobotInstall, indicating a phishing intent. The ML classifier also strongly flagged this as malicious.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://hostmaster.nottageprimary.com/uploads/1/3/0/5/130588894/jazus.pdf
    • http://oraclefitness.com/uploads/1/3/0/2/130289347/1380147.pdf
    • http://corecdinc.com/uploads/1/3/0/7/130775531/jamiwugi_navadobaki_tunususunuleral.pdf
    • http://topecigarettereviews.com/uploads/1/3/0/7/130776394/940acf.pdf
    • http://profpocket.com/uploads/1/3/0/8/130873861/rifinobe.pdf
    • http://dobryakkot.site/uploads/1/3/0/4/130483769/zuzodonuzike.pdf
    • http://celebrationandpartysupplies.com/uploads/1/3/0/7/130740563/9428200.pdf
    • http://ilearnfaster.com/uploads/1/3/0/5/130540814/5677602.pdf
    • http://newtestamentchristianschool.com/uploads/1/3/0/8/130874079/776b15cae6.pdf
    • http://sasquatchsyndicate.org/uploads/1/3/0/4/130475984/dewibusavas.pdf
    • http://queencityministorage.com/uploads/1/3/0/2/130289583/5194088.pdf
    • http://mommasinamood.com/uploads/1/3/0/3/130323511/705267.pdf
    • http://vintagehomecharleston.com/uploads/1/3/0/5/130543064/92256a72.pdf
    • http://kicknsweet.com/uploads/1/3/0/7/130738805/gaxiwamofi.pdf
    • http://carriehohmann.com/uploads/1/3/0/3/130379061/riritudovidi.pdf
    • http://icbrconference.com/uploads/1/3/0/4/130436040/tasamixexabi_togitufoluto_temeg_gefox.pdf
    • http://wcd-z3r6fe.mgh-r.ch/uploads/1/3/0/6/130620846/130620846.html#hemoglobin+concentration+lab+test

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002eab.bin
5027bf67031a5e07e3fcad9acc378ff84f9c74e80491c88a5341ed40967134d2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2EAB 7856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.