Malicious PDF — malware analysis report

Static analysis result for SHA-256 a2906f19018f1eff…

MALICIOUS

PDF

40.5 KB Authoring application: LibreOffice
MD5: 9cffc70e9ebd0db19b2cf75ed1a10b8a SHA-1: 684cf38c1c6d1f535285afeb884aa7c82b6e0fa2 SHA-256: a2906f19018f1effdd6e10ff6810522de18b1d0304a42a8711b16fbbf021fbe1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute malware. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a machine learning classifier also flagged it with high confidence. The document body text is heavily obfuscated and does not provide clear intent, but the heuristic firings strongly suggest a malicious link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://74-123-72-148.mgwnet.com/uploads/1/3/0/6/130604476/e0fb0f0b.pdf
    • http://maysbornlabradors.co.uk/uploads/1/3/0/6/130621098/ropukotin_roxemunesobugat_lofexe.pdf
    • http://theseoengine.com/uploads/1/3/0/4/130436209/40b69f4e.pdf
    • http://ipaint.kparkerdesign.net/uploads/1/3/0/5/130552016/puzuxuv.pdf
    • http://geeksmind.com/uploads/1/3/0/4/130483062/9381096.pdf
    • http://cwrwwtp.com/uploads/1/3/0/2/130272396/gepilogutewafev.pdf
    • http://www.houseofmosaiccandles.com/uploads/1/3/0/4/130436519/53831ec7.pdf
    • http://gottimber.com/uploads/1/3/0/4/130476395/lotosifadubu.pdf
    • http://midwestpark75.com/uploads/1/3/0/5/130551090/a47f2b27c13d.pdf
    • http://aladdinextermination.com/uploads/1/3/0/4/130435594/dbff5ad5d25623.pdf
    • http://healthcoaching.biz/uploads/1/3/0/5/130588206/6910140.pdf
    • http://mamajourneys.com/uploads/1/3/0/3/130313035/malusafesugem.pdf
    • http://netoaterro.com/uploads/1/3/0/6/130621701/zinoni.pdf
    • http://oobboo.com/uploads/1/3/0/5/130588203/lakifeligogakom.pdf
    • http://mrsvoigtsclassroom.com/uploads/1/3/0/6/130605122/nokikemi.pdf
    • http://www.mygvhs.com/uploads/1/3/0/3/130323666/kililusopowevexa.pdf
    • http://mta-sts.villageofhopeministries.org/uploads/1/3/0/8/130874313/tapofujakepe_tojisupo.pdf
    • http://www.bjwoodtx.com/uploads/1/3/0/2/130292098/8938120.pdf
    • http://www.tomwright.ca/uploads/1/3/0/4/130488759/gerugejodinasap_xuxopukusi_pefodaj.pdf
    • http://mail.kushaklaw.com/uploads/1/3/0/5/130588442/8111882.pdf
    • http://www.missmichaud.com/uploads/1/3/0/3/130379611/8014719.pdf
    • http://firstollie.org/uploads/1/3/0/7/130739952/wadavilutasumu-zitigujufiput.pdf
    • http://alvarezorganicfarm.com/uploads/1/3/0/8/130813781/6bfa9805f796a2c.pdf
    • http://hostmaster.buttfarm.co.uk/uploads/1/3/0/7/130776250/130776250.html#can+you+attach+a+pdf+to+an+excel+sheet
    • http://mrsvoigts

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003d85.bin
8594bb23e5b3352476ee292d40c78d073a9ddf696253db9a580a22578a85c450		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3D85 7484 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.