Malicious PDF — malware analysis report

Static analysis result for SHA-256 85fb9a646eaf6b44…

MALICIOUS

PDF

40.0 KB Authoring application: LibreOffice
MD5: 8b842270df80c305bc14965487911ca9 SHA-1: dbc2650d1fa2835ae55c6734d7b9a3cd75d4e4aa SHA-256: 85fb9a646eaf6b440f502a2f12f2076bb085ce8c53e26108f273a14401abef46
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment

The PDF contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. ClamAV also detected this as Pdf.Phishing.TtraffRobotInstall-7605656-0, indicating a phishing or malicious distribution attempt. The ML classifier strongly agrees with the malicious verdict. No scripts were extracted, but the sheer volume of outbound links suggests a coordinated effort to redirect users to potentially malicious content or for SEO spam.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sterlingtoursltdeurope.com/uploads/1/3/0/2/130273798/xifefo.pdf
    • http://responsdirect.no/uploads/1/3/0/2/130289189/6866658.pdf
    • http://catalog2buy.com/uploads/1/3/0/2/130272332/506590.pdf
    • http://urih-art.com/uploads/1/3/0/5/130590200/4398322f816222e.pdf
    • http://binarysv.com/uploads/1/3/0/5/130588418/pubat-xuvomevefiwow-kerivetaximemu.pdf
    • http://firstway.ca/uploads/1/3/0/2/130287291/1654350.pdf
    • http://adventureswithrocks.com/uploads/1/3/0/5/130539992/nedevovemasaj-mebubukapujevu-mufiwevekono.pdf
    • http://dogfriendlyrentalsonsanibel.com/uploads/1/3/0/6/130621462/puvajoginiravag_kerimizal_sonale_kapeximinozelu.pdf
    • http://coopermanselfdefense.com/uploads/1/3/0/2/130291575/cffc0.pdf
    • http://iqcu.net/uploads/1/3/0/4/130483805/telexapekorup-dodoso-sufuj-jegarejosozop.pdf
    • http://inkyelbows.com/uploads/1/3/0/2/130289745/1437087.pdf
    • http://angelaparrishphotography.com/uploads/1/3/0/5/130551615/fagorinafifibipataka.pdf
    • http://fastblueprints.com/uploads/1/3/0/6/130639110/5615796.pdf
    • http://deannapaulsen.com/uploads/1/3/0/6/130639477/lijexe.pdf
    • http://christmaspresentstore.net/uploads/1/3/0/2/130270907/zegulufa_zovuvego_sevik.pdf
    • http://visitcowan.org/uploads/1/3/0/6/130639045/7b3975770325.pdf
    • http://mcgrainz.com/uploads/1/3/0/7/130738543/xuwozipilixoxipu.pdf
    • http://niveditainstitutions.com/uploads/1/3/0/5/130543656/59737789c1bc52.pdf
    • http://whitewatercottages.com/uploads/1/3/0/6/130621044/kuberinora.pdf
    • http://joiasands.com/uploads/1/3/0/4/130488983/mosamowi_zenudagofowewed.pdf
    • http://prime-yourself.com/uploads/1/3/0/7/130775196/7220411.pdf
    • http://pmcpaintingscom.com/uploads/1/3/0/5/130544672/1495905.pdf
    • http://gostudiom.com/uploads/1/3/0/7/130776177/voxifukuke.pdf
    • http://nabyou.com/uploads/1/3/0/7/130739459/4a23cb84652839b.pdf
    • http://nicolitulk.com.au/uploads/1/3/0/4/130479312/130479312.html#visual+paradigm+activity+diagram+fork

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003841.bin
97d69469857183cce4bc2e2745faba3c6663bee698cf41d421ffb69f7b0f4ea2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3841 8176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.