Malicious PDF — malware analysis report

Static analysis result for SHA-256 a1ad3c605d6fe0f0…

MALICIOUS

PDF

37.7 KB Authoring application: OpenOffice Draw
MD5: 9868e17b12e4e4b36187dae0f8b0de80 SHA-1: 3391ffbe75f0e710c033c96df980ce7c3fb059cc SHA-256: a1ad3c605d6fe0f0e4048553ef9f0426b3608fecd753654150aacc6445c3dbd8
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection and ML classifier also flagged this file as malicious. The embedded URLs suggest a link farm designed to redirect users to potentially malicious content or phishing sites. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://audicionamericas.com/uploads/1/3/0/6/130621100/nugavelan.pdf
    • http://michiganreflexology.com/uploads/1/3/0/6/130604312/sadorawuzo.pdf
    • http://saintclairstorage.com/uploads/1/3/0/3/130324170/redebugex.pdf
    • http://rememberproperty.com/uploads/1/3/0/6/130621854/ebe738b0dd033f.pdf
    • http://nelsonkimeofficial.com/uploads/1/3/0/3/130379474/zolibuv.pdf
    • http://www.janeelizabethhealing.com/uploads/1/3/0/8/130874134/febejivadoja-tudagusimitebi-kumutur-xilegokanotok.pdf
    • http://marijuanacultivationconsultants.com/uploads/1/3/0/7/130776177/10d3b342d220789.pdf
    • http://enclaveusa.com/uploads/1/3/0/7/130775268/109d1be5.pdf
    • http://ericgilham.com/uploads/1/3/0/3/130323761/8222085.pdf
    • http://millennialjapan.com/uploads/1/3/0/6/130604014/jitibab.pdf
    • http://clue.show/uploads/1/3/0/6/130604838/1ace83.pdf
    • http://equipajedemano.com/uploads/1/3/0/6/130620320/fogib.pdf
    • http://makerandink.com/uploads/1/3/0/2/130289618/3021730.pdf
    • http://tulipcupcakeliners.com/uploads/1/3/0/6/130621306/jokakisalisimil.pdf
    • http://massageforthemasses.com/uploads/1/3/0/6/130620836/nijapesovikek.pdf
    • http://tcgmgm.com/uploads/1/3/0/7/130775498/dolupogi.pdf
    • http://makeguillotinesgreatagain.com/uploads/1/3/0/4/130476066/6756502.pdf
    • http://ls7xy.bpmtc.com/uploads/1/3/0/6/130640133/130640133.html#singing+from+diaphragm+exercises
    • http://marijuanacultivationconsultants.com/uploads/1/3/0/7/130776177/10d3b342d

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000381a.bin
bec49b0a5db3718c829e0c056e91e269bf91859bbab186be6ff4f92597cece41		 pdf-font-stream PDF embedded font (sfnt) at offset 0x381A 7532 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.