Malicious PDF — malware analysis report

Static analysis result for SHA-256 76295ddc60bec5d2…

MALICIOUS

PDF

39.5 KB Authoring application: LibreOffice Draw
MD5: c4e97a4dc1d815ce252013f30642a535 SHA-1: 898c9242daf83ee3019aae23660b86e3d84ef07a SHA-256: 76295ddc60bec5d24b7b31bc1d54907aed20d05c3e1cecde1b341b908f49033d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, a technique often used for SEO manipulation or to redirect users to malicious content. ClamAV identified this as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection purpose. The ML classifier also strongly flagged this as malicious. No scripts were extracted, and the document body was unreadable.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://amdlifestylemgmt.com/uploads/1/3/0/6/130621331/75eb5c2ac508.pdf
    • http://www.the-off-topic-show.com/uploads/1/3/0/5/130551013/bupulunojuwavubuwuno.pdf
    • http://deannapaulsen.com/uploads/1/3/0/4/130436226/c2f818005b9f4.pdf
    • http://windowpeel.com/uploads/1/3/0/6/130620579/aca364a529b.pdf
    • http://mickeyandmalia.com/uploads/1/3/0/6/130604649/xidukekefija.pdf
    • http://watsonstestsite.com/uploads/1/3/0/5/130551019/4f39541.pdf
    • http://nuheila-art.com/uploads/1/3/0/4/130489969/39bc1c36.pdf
    • http://panamacitybeachsurf.com/uploads/1/3/0/4/130476004/zukenixulubik.pdf
    • http://miss-america-protest.com/uploads/1/3/0/6/130639762/9738783.pdf
    • http://ovbeyondtherainbow.org/uploads/1/3/0/5/130590325/zaninifamejuziwuxud.pdf
    • http://analogi.us/uploads/1/3/0/4/130483047/pototoxikegaxusurex.pdf
    • http://pugetsoundbfw.com/uploads/1/3/0/5/130546717/8092985.pdf
    • http://drinkingitin.com/uploads/1/3/0/4/130476062/veles.pdf
    • http://amychurmt.com/uploads/1/3/0/5/130546759/werivosedu.pdf
    • http://pricewaterhousecoopers.us/uploads/1/3/0/6/130621392/bevexeroleka.pdf
    • http://jdstudy.net/uploads/1/3/0/5/130546434/zitubosetatidax.pdf
    • http://www.radioactiveglass.com/uploads/1/3/0/8/130813768/33939c07.pdf
    • http://www.cookiesandcreamsouthpas.com/uploads/1/3/0/8/130814855/1d1c2cfb4f.pdf
    • http://northshorebostonrealtor.com/uploads/1/3/0/3/130379381/f9dc8f9.pdf
    • http://baylaurelgroup.com/uploads/1/3/0/7/130739492/pizemilebegudid.pdf
    • http://customerfocusedlearning.com/uploads/1/3/0/4/130483860/novusapezapejivijuro.pdf
    • http://bbnla.com/uploads/1/3/0/2/130291552/493e34ceb1.pdf
    • http://newarkvalley.org/uploads/1/3/0/6/130604198/d508f5eb639.pdf
    • http://ronawatts.com/uploads/1/3/0/6/130621114/damixub.pdf
    • http://1tei2.slpny.com/uploads/1/3/0/5/130539033/130539033.html#zondervan+kjv+bible+dictionary+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000036c3.bin
606883423aa2b2924aa9e23bfb08a8b88aba4d3eb9d56ce2a94bb970973b2757		 pdf-font-stream PDF embedded font (sfnt) at offset 0x36C3 8116 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.