Malicious PDF — malware analysis report

Static analysis result for SHA-256 a855b61c7a9e51f5…

MALICIOUS

PDF

40.9 KB Authoring application: LibreOffice Draw
MD5: 1d88a44ea725337e551f0bc5cbd71e54 SHA-1: 67000f3f3073c0be3c4a4d7df6606e49fa86c38d SHA-256: a855b61c7a9e51f5402f4da8b896f49edefde26c7637ab634fb0477affc67753
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was flagged by multiple heuristics, including a critical finding for a PDF link farm and ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body contains embedded URLs pointing to external PDF files, suggesting a phishing or SEO spam campaign. No scripts were extracted, limiting the analysis of direct malicious actions.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mdcurbside.net/uploads/1/3/0/3/130323750/nofena_tawemataz_luzir_fetijazi.pdf
    • http://strengtheningfamiliesalaska.com/uploads/1/3/0/5/130590111/98bd4bfb27.pdf
    • http://aerohive.tech/uploads/1/3/0/5/130538985/56cee00ab5e8c09.pdf
    • http://appsolutecaregroup.com/uploads/1/3/0/6/130639373/43f4eb21.pdf
    • http://bellovaporizer.com/uploads/1/3/0/2/130287813/2832075.pdf
    • http://misbailes.com/uploads/1/3/0/5/130540106/130540106.html#chokher+bali+movie+song+download

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010da.bin
4e9572b62ae310340a944c1ae83e945c41b021bf2c4ee0db3adb1013c00e3a81		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10DA 8584 bytes
font_01_sfnt_off00005c53.bin
24a40f0c9c24c31f4e84abf4b16dd01585b0ada3efa18570b63d2792f0c05475		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5C53 7108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.