Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d1368498f3a6627…

MALICIOUS

PDF

38.6 KB Authoring application: LibreOffice
MD5: 20b491799ca47b415cdf7c2d34485bd2 SHA-1: 412a9faaef45ece77c7d1336ddf502e3ce36ba8f SHA-256: 8d1368498f3a66271a18abd0405d494775479ed0b73f851fc6c06547a307fda1
152 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files hosted on various domains, indicating a link farm or SEO manipulation tactic. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall, suggesting a phishing or traffic redirection scheme. The ML classifier also strongly indicated maliciousness. No scripts were extracted, limiting the analysis of direct payload execution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rubymacfashion.com/uploads/1/3/0/6/130620154/muzidekenuzunif_gumolevo_pomuselupowe.pdf
    • http://irisvanheesewijk.nl/uploads/1/3/0/5/130550794/rotinufuvagu.pdf
    • http://bertangevaare.com/uploads/1/3/0/6/130603815/9438362.pdf
    • http://www.askachillers.com/uploads/1/3/0/4/130488371/7ae65b75.pdf
    • http://nudevember.net/uploads/1/3/0/6/130640033/vexalusubokaf.pdf
    • http://channelingthelight.com/uploads/1/3/0/7/130739029/05544f3091ff74.pdf
    • http://hostmaster.artem-medicalis.com/uploads/1/3/0/5/130551967/6927878.pdf
    • http://www.maureencreations.net/uploads/1/3/0/7/130740213/691726885c32d.pdf
    • http://alittlegroomroom.org/uploads/1/3/0/6/130640048/8004061.pdf
    • http://mta-sts.lusannahoddell.com/uploads/1/3/0/2/130289558/nuxezirago.pdf
    • http://clickblossom.com/uploads/1/3/0/4/130476732/vuxopatixudin_raweturuko_nizowosot.pdf
    • http://themercuriogallery.com/uploads/1/3/0/7/130775917/kudojaze.pdf
    • http://paperjapan.com/uploads/1/3/0/7/130776485/dedezar-loxofilaj.pdf
    • http://dandreams.com/uploads/1/3/0/5/130540453/dijogogejatogi-fodipidedo-tunusetediju.pdf
    • http://dixieraised.com/uploads/1/3/0/6/130639311/xerinajanasafos.pdf
    • http://mail.learntoroar.com/uploads/1/3/0/4/130483949/1344544.pdf
    • http://boylston275.org/uploads/1/3/0/6/130639661/zinerusu.pdf
    • http://qualloworldonelovetravel.voyagerwebsites.com/uploads/1/3/0/5/130588487/130588487.html#pdf+to+ocr+converter+free+download
    • http://mta-sts.lusannahoddell.com/uploads/1/3/0/2/130289558/nuxezirago.pd

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003b9c.bin
033007480fc7de83129eda33b642b7a5c2eeca432d688b088dce5deebe04b288		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B9C 7416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.