Malicious PDF — malware analysis report

Static analysis result for SHA-256 7fe30a54c93dda99…

MALICIOUS

PDF

44.3 KB Authoring application: LibreOffice Draw
MD5: 3e5a278c7023686614b3af4d73b619db SHA-1: 1cb097a6c4247a27be100d08bfb6910d5413956d SHA-256: 7fe30a54c93dda99cc801aa640992e0fbdc30fe524d10d929c5c2086ba097f22
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. ClamAV also detected this as Pdf.Phishing.TtraffRobotInstall-7605656-0, suggesting a phishing or malicious redirection intent. The embedded URLs likely lead to further malicious content or phishing pages.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.rocketroys.com/uploads/1/3/0/2/130291485/421c70797e.pdf
    • http://surfergirl.us/uploads/1/3/0/6/130622025/pivusanusaf-pitumijokev-gigavo-zopugodurit.pdf
    • http://paramountbuilders.co.uk/uploads/1/3/0/7/130739376/7624997.pdf
    • http://armidalebushwalkers.org/uploads/1/3/0/2/130270872/vabukewuxudir.pdf
    • http://e-techbooks.com/uploads/1/3/0/6/130605019/1be5a8be0857.pdf
    • http://casperoilfield.com/uploads/1/3/0/7/130738796/mogulimawek_kikajidoj_duguxuw_wasezuw.pdf
    • http://trustedservicesgp.com/uploads/1/3/0/6/130604202/5476b96c4.pdf
    • http://petrapreschool.net/uploads/1/3/0/5/130540789/5248227.pdf
    • http://rebeccalcabrera.com/uploads/1/3/0/2/130288361/3235aa63.pdf
    • http://gatewaytakanini.co.nz/uploads/1/3/0/3/130313434/mobezutogedefa-kavetuxat-gejadekoloxafe.pdf
    • http://chris4swissvale.com/uploads/1/3/0/6/130639081/xixoje-senepix-pigupuzeji-junakot.pdf
    • http://hostmaster.meronsalon.com/uploads/1/3/0/5/130551795/lewugonuleluboz-supusi-tepejoxe-wodofoke.pdf
    • http://ht.sondrafinancialservicesllc.com/uploads/1/3/0/3/130323466/130323466.html#airtel+dth+price+chennai
    • http://dejavu.sourceforge.net
    • http://dejavu.sourceforge.net/wiki/index.php/License

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003a43.bin
32b54217619f9438721b423dc2f4f4da0f78781b0811ea49af2be6b0310ecf56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A43 16164 bytes
font_01_sfnt_off0000524f.bin
a0b6a08ac732470f8886e4bc04deea8315ea025fb6756417fdd2d1a6acd6139b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x524F 8892 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.