Malicious PDF — malware analysis report

Static analysis result for SHA-256 70702bb7d29d19ad…

MALICIOUS

PDF

37.2 KB Authoring application: LibreOffice First seen: 2021-06-13
MD5: fd18b43f82d06a98b5b0cf01fd07c664 SHA-1: 01ae21b3b5e41a55a3a2bce151846ba54e07b7bc SHA-256: 70702bb7d29d19ad7296ae3a7cb492885ae16af4fa7f2bf3315954e52d9f6d73
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file was detected as malicious by multiple engines, including ClamAV, which identified it as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The primary heuristic firing indicates a large number of embedded external links, suggesting a link farm or redirection tactic. While no scripts were explicitly extracted, the presence of embedded URLs and the nature of the detection point towards a phishing or malicious content delivery mechanism, likely initiated via a spearphishing attachment.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://performanceinc.club/uploads/1/3/0/2/130270752/de604e7bed48ba.pdf In PDF document text
    • http://bwmin.org/uploads/1/3/0/5/130550841/gipeke.pdfIn PDF document text
    • http://sake.militaryfreak.com/uploads/2020/01/27/62c98bd.pdfIn PDF document text
    • http://aeronika.com/uploads/2020/01/28/2522860.pdfIn PDF document text
    • https://suwigotiwuziw.weebly.com/uploads/1/3/0/6/130605116/xewavizuvilasu.pdfIn PDF document text
    • http://bite.rostov-posutochno.ru/uploads/2020/01/28/8123179.pdfIn PDF document text
    • http://3ndfl-nalogi.ru/uploads/2020/01/27/worozobakejoko.pdfIn PDF document text
    • http://benrobinsongroundphotos.weebly.com/uploads/1/3/0/5/130540097/3db8ed91ce.pdfIn PDF document text
    • http://wuxufotuba.xelamit.ru/uploads/2020/01/27/teruzum.pdfIn PDF document text
    • http://jodellecreative.com/uploads/1/3/0/6/130621515/fipoj-mexawoj-ziravikepuk.pdfIn PDF document text
    • https://fewevexevupubi.weebly.com/uploads/1/3/0/4/130476579/jikoz.pdfIn PDF document text
    • http://plainenglishfordoctors.com/uploads/1/3/0/5/130550789/7956981.pdfIn PDF document text
    • https://doxolaxewuju.weebly.com/uploads/1/3/0/2/130287872/gopakibu.pdfIn PDF document text
    • http://live-fasted.com/uploads/1/3/0/6/130620560/sakitopeduvuwe.pdfIn PDF document text
    • https://wosapola.weebly.com/uploads/1/3/0/3/130313247/dinojazovogixe.pdfIn PDF document text
    • http://mywonderowl.com/uploads/1/3/0/6/130621794/130621794.html#sistema+de+informacion+internoIn PDF document text

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013af.bin pdf-font-stream PDF embedded font (sfnt) at offset 0x13AF 7860 bytes
SHA-256: f83ded2085a78654fc9c03f894f0a25a7ddb4624eb6decaa213fbbf9447fa24e

Open this report in the interactive analyzer, or submit your own file for analysis.