Malicious PDF — malware analysis report

Static analysis result for SHA-256 6df8369ffe252ced…

MALICIOUS

PDF

37.1 KB Authoring application: LibreOffice Draw
MD5: d48e6bdb0f621023bcf880e82c11d2af SHA-1: dca722b0b427fc74e6ef791f4117fb1f306f7f57 SHA-256: 6df8369ffe252ceda5a15de5762d43998ae9162137c7ddb270da64fc06a6f4b6
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1203 Exploitation for Client Execution

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a tactic to manipulate search engine results or distribute malicious content. The ClamAV detection and ML classifier further support its malicious nature, classifying it as Pdf.Phishing.TtraffRobotInstall-7605656-0.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9997

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://organizedmess.net/uploads/1/3/0/2/130289476/mobajip-pigev.pdf
    • http://ajmemorialevent.org/uploads/1/3/0/5/130539871/763d713.pdf
    • http://mygametruckcostamesa.com/uploads/1/3/0/6/130639364/7043584.pdf
    • http://optimaltherapymassageandbodywork.com/uploads/1/3/0/6/130622095/fagenumuzegatoxobibu.pdf
    • http://tidaleffects.net/uploads/1/3/0/7/130776120/giniseve.pdf
    • http://loveaverage.com/uploads/1/3/0/8/130874669/823724.pdf
    • http://castawaycustomsmidwest.com/uploads/1/3/0/4/130435574/4389791.pdf
    • http://ns2.oldpathsdzingre.org/uploads/1/3/0/6/130604735/nilirirug_kexeb.pdf
    • http://qikbuild.com/uploads/1/3/0/7/130775645/fawiwisewugej.pdf
    • http://soundtransitfacts.org/uploads/1/3/0/6/130639199/3942513.pdf
    • http://healthcareanalyticsmergers.com/uploads/1/3/0/6/130621656/rimonobowokujunar.pdf
    • http://mail.countryhillscrematorium.com/uploads/1/3/0/5/130588415/zukoteso.pdf
    • http://br946.slpny.com/uploads/1/3/0/5/130588299/130588299.html#arduino+uno+led+blink+program
    • http://www.ascendercorp.com/
    • http://www.ascendercorp.com/typedesigners.html
    • https://fedoraproject.org/wiki/Licensing/LiberationFontLicense

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002c44.bin
d8435aac11388b8214bfc980e857510ef47481ba706565f25bd6cae8efb01319		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2C44 2828 bytes
font_01_sfnt_off000038c6.bin
1bc7f990b05e66cde365f2703ab6c461d7d609e9aca0ac9f3189fa69ba083dc2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x38C6 7952 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.