Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab1d9dc408f4ee0d…

MALICIOUS

PDF

55.7 KB Authoring application: OpenOffice.org
MD5: cd00970b8fb8ce8bff8dcd013c5ac3d1 SHA-1: 16973a76e4f491fb61b9fd0041e4ca42e8496132 SHA-256: ab1d9dc408f4ee0d95294d61ea0a0e002a444bc150ee3107c53e2f3f35fe299b
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF was flagged by multiple critical heuristics, including ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and a PDF link farm detection. The document body, though heavily obfuscated, contains references to URLs that are also listed as embedded URLs. These URLs point to other PDF files, suggesting a chain of redirection likely intended to deliver malicious content or phish for credentials.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9976

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nourishhealthservices.com/uploads/1/3/0/2/130272586/a6fd696841c23.pdf
    • http://kentuckyroutezero.net/uploads/1/3/0/5/130539229/5431457.pdf
    • http://advancedliferesources.com/uploads/1/3/0/4/130488500/rusonigit.pdf
    • http://mothersmilkisbest.com/uploads/1/3/0/3/130312952/tiromidozasote_loxiju_wixemurale.pdf
    • http://design-strong.com/uploads/1/3/0/5/130545957/saxivomo.pdf
    • http://bsa-sccc-pack301.com/uploads/1/3/0/4/130436494/130436494.html#lang+lang+rachmaninoff+piano+concerto+no+2

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001190.bin
49032e63452f5684dfa3b8030e4c39a09f1c6b0aebe792d2891d025371decd13		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1190 10440 bytes
font_01_sfnt_off00007ac6.bin
8543b436534ecf2a9af7d8022b6a0fe6e55cf95115e92c455020ddd94658226f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7AC6 5172 bytes
font_02_sfnt_off00008aad.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8AAD 2652 bytes
font_03_sfnt_off0000937d.bin
0d355b956a9dff8708fe1b1ecbbec6815800202606c49a7e1bd1898687aadaa0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x937D 16120 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.