Malicious PDF — malware analysis report

Static analysis result for SHA-256 87cc1bd94c143d6a…

MALICIOUS

PDF

36.2 KB Authoring application: LibreOffice
MD5: f4b13fc0740868d01842756c2bd48ef8 SHA-1: 32e5f700f8c8b8858eda0f6642e023ff379b8395 SHA-256: 87cc1bd94c143d6a2ba9a96057defda189ddbf2ca7553437568f7579cbb2d9fe
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded URLs pointing to other PDF files, indicating a link farm or redirection scheme. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support a malicious intent. The document body, though partially corrupted, mentions LibreOffice and Adobe Acrobat, suggesting a lure related to document editing or viewing. The primary attack pattern involves directing users to a multitude of external PDF resources.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.algebra.mybooksucks.com/uploads/1/3/0/8/130874377/3c9d47.pdf
    • http://bridgeequityadvisor.com/uploads/1/3/0/6/130620635/7671f6233e86b8e.pdf
    • http://www.fjffox.com/uploads/1/3/0/5/130589285/a7d5519b0.pdf
    • http://mycarenow.us/uploads/1/3/0/6/130620173/dabuves-muvojekimeniw-pazegezisalex.pdf
    • http://kimlamb.art/uploads/1/3/0/4/130435839/8323782.pdf
    • http://arty-lab.com/uploads/1/3/0/7/130775675/7379475bf1.pdf
    • http://mortgagelenderharry.com/uploads/1/3/0/5/130543483/nanuxito-sutizopobe-vobuzililupabib.pdf
    • http://theweddingcollective.com.au/uploads/1/3/0/4/130478261/6967342.pdf
    • http://webmail.grandriverblues.org/uploads/1/3/0/6/130604911/3980600.pdf
    • http://dofnelsonfaithfomation.com/uploads/1/3/0/5/130544823/7b57b3b7f74af.pdf
    • http://00964.net/uploads/1/3/0/7/130740082/4914272.pdf
    • http://myptsdveteran.com/uploads/1/3/0/7/130740072/952293e9d633a0.pdf
    • http://angryselfloathingbabies.net/uploads/1/3/0/8/130813780/nebeviginefag.pdf
    • http://faithlifetv.org/uploads/1/3/0/2/130270823/kafopudajeweroduvep.pdf
    • http://huepfstern.com/uploads/1/3/0/7/130774999/4250744.pdf
    • http://limassolartgallery.com/uploads/1/3/0/6/130603958/2525763.pdf
    • http://dollywoodshirts.com/uploads/1/3/0/2/130289177/bugubezab.pdf
    • http://mrswatsonsroom.com/uploads/1/3/0/2/130291779/327c676e5534.pdf
    • http://www.virginiabeachdominatrix.com/uploads/1/3/0/3/130324331/0515289e88cf5f.pdf
    • http://atstestkits.com.au/uploads/1/3/0/7/130775163/gonomoxijog.pdf
    • http://trojantailgateclub.com/uploads/1/3/0/6/130639155/vezonularexiriwak.pdf
    • http://wcd-ont9trwo.mgh-r.ch/uploads/1/3/0/7/130739697/130739697.html#adobe+acrobat+7+change+font+size+text+box
    • http://dollywoodshirts.com/uploads/1/3/0/2/130289

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002dd6.bin
2eb16fa9376405c521f4ef6b1305842c0b50335804164520b34148dae51bd53f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2DD6 7620 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.