Malicious PDF — malware analysis report

Static analysis result for SHA-256 75fc98ae1df1e8b1…

MALICIOUS

PDF

31.3 KB Authoring application: OpenOffice Draw
MD5: 9c20f8295a36a9a4ee82a1883cd84710 SHA-1: 92256302959922e2579187f44ae57a9c879b6eb9 SHA-256: 75fc98ae1df1e8b14103299ddb722428914eb63dbf4c626c95585a54ecf33fec
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains a large number of embedded URLs pointing to external PDF documents across various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as flagged by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV detection strongly support its malicious nature.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://famcoinsurance.com/uploads/1/3/0/4/130477074/bolef.pdf
    • http://njetd.com/uploads/1/3/0/6/130621214/dowexagewoxi.pdf
    • http://barrysatvadventures.com/uploads/1/3/0/7/130739147/9200811.pdf
    • http://mothersdaymilers.org/uploads/1/3/0/5/130551864/8946472.pdf
    • http://moonrisetours.com/uploads/1/3/0/6/130604799/6952325.pdf
    • http://earthquakesafety101.com/uploads/1/3/0/5/130543025/bbe3885.pdf
    • http://atombeauty.com/uploads/1/3/0/6/130621137/guvekiwepador_faretewe_jofake_kosekon.pdf
    • http://safeketozone.com/uploads/1/3/0/5/130542991/wopok.pdf
    • http://donmcqueenart.com/uploads/1/3/0/6/130621373/1676090.pdf
    • http://treetopsimplicity.com/uploads/1/3/0/7/130775820/maxebezomi.pdf
    • http://pressburg-partners.com/uploads/1/3/0/5/130540293/binisiwav.pdf
    • http://manwithgunband.com/uploads/1/3/0/5/130544386/130544386.html#vocabulary+workshop+level+f+unit+5+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001415.bin
651c0608c11badce35c5d47ba41199c254d5b05c2ba01a1652e1b4de00199dbe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1415 7964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.