Malicious PDF — malware analysis report

Static analysis result for SHA-256 94c5480ddd43517d…

MALICIOUS

PDF

33.6 KB Authoring application: OpenOffice Draw
MD5: ae02f57f36f0b8bc5fe6901874f31f93 SHA-1: 56f5566c4daf4b5d266b7c42e854990e7e8cbccd SHA-256: 94c5480ddd43517d61d59f46c1704b414a62d7da029a1312e2fd2b8388fba34d
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or SEO spam campaign, where the goal is to redirect users to malicious or deceptive content hosted on numerous domains. The ML classifier and ClamAV detection further support the malicious nature of this file. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://jinwonhanglass.com/uploads/1/3/0/5/130588714/2830752.pdf
    • http://yctl.org/uploads/1/3/0/7/130775053/05ffebde1aef.pdf
    • http://digitalnomadcareer.com/uploads/1/3/0/3/130313090/8116442.pdf
    • http://fuckgeese.com/uploads/1/3/0/4/130436202/vanitawozufa-mizejesa-bakumek.pdf
    • http://biblesforchinaphotos.com/uploads/1/3/0/6/130604950/6f7b233627cc0.pdf
    • http://oslorelocationservices.com/uploads/1/3/0/5/130540507/e582a089cb6.pdf
    • http://zoomi-inc.net/uploads/1/3/0/6/130621859/pefagazedi-xadonixiteta-finukunixi-kenased.pdf
    • http://sberprize.space/uploads/1/3/0/4/130488227/5e2be294cf6d370.pdf
    • http://biblechapteraday.com/uploads/1/3/0/5/130550729/6345898.pdf
    • http://budgetboutiquebeds.com/uploads/1/3/0/3/130313082/morasodavomo-penelusumi-rewivajufon-nogelilowugib.pdf
    • http://usatfregistration.com/uploads/1/3/0/7/130738971/2047696.pdf
    • http://ashonfood.com/uploads/1/3/0/6/130603767/3ba48dd1689f965.pdf
    • http://accontrolequalite.com/uploads/1/3/0/3/130379492/1201860.pdf
    • http://nextreview.com/uploads/1/3/0/5/130539837/gezafozobirurawasur.pdf
    • http://myescondidosoccer.com/uploads/1/3/0/6/130639061/208300.pdf
    • http://webdisk.coprimag.com/uploads/1/3/0/6/130640125/130640125.html#low+carb+menu+plan+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000029d9.bin
9c89c76d6e429fb2d9072596928e3abe5030cfcc31c4653677296b14007b35ab		 pdf-font-stream PDF embedded font (sfnt) at offset 0x29D9 7356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.