Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2067f960c60d627…

MALICIOUS

PDF

38.1 KB Authoring application: OpenOffice Draw
MD5: b123685cb045822b3c66c38081cb71dd SHA-1: 7b5563fb81e712a98864ea20096a558a77efba38 SHA-256: a2067f960c60d6279238d7fa29f240f2983d07990e19d38897a5ad984eb513aa
150 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, a technique often used for SEO spam or to distribute malware. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent. The document body text is largely unreadable, but the presence of numerous links suggests a content-driven lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.javanhirst.com/uploads/1/3/0/2/130289662/a05c2e5.pdf
    • http://beautyinyouhairsupply.com/uploads/1/3/0/6/130639867/c430e.pdf
    • http://www.learning2leaddaily.com/uploads/1/3/0/7/130775174/8844028.pdf
    • http://crystalclearings.com/uploads/1/3/0/6/130639380/nikepuxugixo.pdf
    • http://konasunsets.net/uploads/1/3/0/6/130604682/wekowalonog.pdf
    • http://stonesoaps.com/uploads/1/3/0/2/130272232/wagep-senonexukilizu-sidabuwasodud-suluku.pdf
    • http://bbs.banjodanielmusic.com/uploads/1/3/0/5/130550704/4717713.pdf
    • http://oasismassagemckinney.com/uploads/1/3/0/5/130541285/4c70e87c1f95865.pdf
    • http://0101001101001011.com/uploads/1/3/0/6/130604025/68c0d.pdf
    • http://www.rankinsites.com/uploads/1/3/0/2/130270956/d76249a0553c03a.pdf
    • http://mentok.net/uploads/1/3/0/6/130639865/zazipilo.pdf
    • http://traderlawyers.com/uploads/1/3/0/5/130544703/41284.pdf
    • http://bigdatahq.com/uploads/1/3/0/6/130604737/a27ec45f08b81.pdf
    • http://bungalows-semidees.com/uploads/1/3/0/2/130287500/bosodi.pdf
    • http://babymyo.com/uploads/1/3/0/4/130435777/momimifugarakeju.pdf
    • http://www.mirrorsireland.com/uploads/1/3/0/6/130639380/tojoxir_nidumet.pdf
    • http://scopeclothing.co.nz/uploads/1/3/0/4/130483345/ff5f7c7.pdf
    • http://74-123-76-227.mgwnet.com/uploads/1/3/0/7/130776308/130776308.html#convert+direct+speech+into+indirect+speech+online
    • http://www.rankinsites.com/uplo

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000035ec.bin
9d0408e16a1567480162358da18daf5427e63f28f9c54981a68456bcdd8287d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x35EC 8728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.