Malicious PDF — malware analysis report

Static analysis result for SHA-256 8a0d75a4ba1cac32…

MALICIOUS

PDF

45.1 KB Authoring application: LibreOffice
MD5: 19ed4da32a3281ed235f754491af4108 SHA-1: c65d024b77efae5a5ef33ae99135d3b11b1ac1ec SHA-256: 8a0d75a4ba1cac32cbe7edf2ec7a6cb115fcd7ed4630a2e436a2add05e278873
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

This PDF file was flagged by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0 and a machine learning classifier with high confidence. The heuristic PDF_SEO_LINK_FARM indicates the presence of a large number of external PDF links, with the first being http://safecleanasc.com/uploads/1/3/0/2/130272505/16297e6cd.pdf. The document body contains these same URLs, suggesting the primary purpose is to redirect users to these external resources, potentially for phishing or malware distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://safecleanasc.com/uploads/1/3/0/2/130272505/16297e6cd.pdf
    • http://qbedsandbedding.com/uploads/1/3/0/2/130272932/2132e0712f56.pdf
    • http://abdelbassitsenhadji.com/uploads/1/3/0/5/130588678/jimilagujulewisexew.pdf
    • http://paulsmusicacademy.com/uploads/1/3/0/5/130544702/tojufiwif.pdf
    • http://moms-life.net/uploads/1/3/0/6/130639114/99cbfb0b403e.pdf
    • http://ngravinggifts.shop/uploads/1/3/0/6/130604248/ropur.pdf
    • http://tuslawmustangsfootball.com/uploads/1/3/0/5/130550912/1469735.pdf
    • http://mpautosales.co/uploads/1/3/0/4/130435500/wedopajewumexajuwi.pdf
    • http://falconfoodmart.com/uploads/1/3/0/2/130270849/3111525.pdf
    • http://radardogs.net/uploads/1/3/0/2/130271035/jobugemusegu.pdf
    • http://nicholascomm.com/uploads/1/3/0/6/130605269/48616909a.pdf
    • http://sharedtravel.voyagerwebsites.com/uploads/1/3/0/2/130271077/130271077.html#holt+world+history+ancient+civilizations+textbook+pdf

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012fb.bin
5be8a78174d1563747b569048e7f588b83cafe7f748a38a4b82b80fd5205b0b7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12FB 9116 bytes
font_01_sfnt_off00006871.bin
f2dcad1c4e385467fd909aab4269c5338958741635a8364c5f76ef981335d49c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6871 16420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.