Malicious PDF — malware analysis report

Static analysis result for SHA-256 a224938781532fe4…

MALICIOUS

PDF

35.2 KB Authoring application: LibreOffice Draw
MD5: 346938c113b08e4f10938aa3d8e2dd52 SHA-1: 45c4013bb3c87ab796ec2711d0c5c07fe3afa9f6 SHA-256: a224938781532fe4b2418a3e2cdaa08a77ebf7299c3e34875478a8e61c8bb257
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDF files, a technique commonly used for SEO poisoning or to distribute further malicious content. The ClamAV detection and ML classifier strongly indicate malicious intent. The embedded URLs are likely part of a link farm designed to redirect users to malicious sites or download further malware.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://myturkishcoffee.com/uploads/1/3/0/5/130551772/8daf00f24620db.pdf
    • http://containerbuyers.net/uploads/1/3/0/2/130288565/454f1c.pdf
    • http://productmanagementservices.org/uploads/1/3/0/2/130273582/15418a2ac0c71a.pdf
    • http://minutegrillers.com/uploads/1/3/0/7/130739346/7775360.pdf
    • http://nicholebertucci.com/uploads/1/3/0/2/130270936/7f19145e71dd.pdf
    • http://myopoa.com/uploads/1/3/0/7/130739131/bodizupu.pdf
    • http://nuskin-success.com/uploads/1/3/0/5/130551714/bufevegom-vafarepizigep.pdf
    • http://mjrich.net/uploads/1/3/0/3/130379182/2755558.pdf
    • http://clabsi.com/uploads/1/3/0/5/130539021/2366884.pdf
    • http://www.elinedebecker.com/uploads/1/3/0/6/130640141/52f2ba.pdf
    • http://host139.carmichaelnl.com/uploads/1/3/0/8/130874488/130874488.html#m40+concrete+mix+ratio

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003153.bin
a608f92a965aa60af619973aae271e04c6639dffe970d29040c2ef22f0f3a534		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3153 8792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.