Malicious PDF — malware analysis report

Static analysis result for SHA-256 b091afe9ea677073…

MALICIOUS

PDF

44.7 KB Authoring application: OpenOffice.org
MD5: 0bcc6d2d9404494f2ac8f736c1f32094 SHA-1: 83d3ca5e0561ddf90c461efb47439b8169083332 SHA-256: b091afe9ea6770733e3d953f86f526978d3a06635e40d50b7107782489483db1
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, suggesting a link farm or redirection strategy. ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or traffic redirection intent. The ML classifier also strongly indicated maliciousness. No scripts were extracted from this sample.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://security-exam.com/uploads/1/3/0/6/130621068/5bf62f2da8a.pdf
    • http://youngmenofrespect.org/uploads/1/3/0/7/130740297/zosid.pdf
    • http://rhksmartyhotels.devsite-1.com/uploads/1/3/0/6/130622111/8592489.pdf
    • http://employerofrecord.services/uploads/1/3/0/7/130775744/kadosezujo.pdf
    • http://southwestvfd.com/uploads/1/3/0/6/130639138/xalabukemadubub_pugimeb_lixufegapukob_vuwexivamuse.pdf
    • http://coachcreatecollaborate.com/uploads/1/3/0/6/130605206/9911969.pdf
    • http://mail.embellishmentsanddesigns.com/uploads/1/3/0/7/130739711/silejuwazevu.pdf
    • http://astrologyandcrystallighttherapy.com/uploads/1/3/0/4/130476589/9757644.pdf
    • http://abbeysowick.com/uploads/1/3/0/6/130620327/6846f38815f662.pdf
    • http://hostmaster.westyorkshirefurniture.co.uk/uploads/1/3/0/7/130740224/mufulikarin-pivotufemib-fazir.pdf
    • http://www.happycakesgreenville.com/uploads/1/3/0/5/130543979/f4735df5d3.pdf
    • http://www.chixwhovibe.com/uploads/1/3/0/8/130874492/demupevuxinubotugubu.pdf
    • http://lellynphotography.org/uploads/1/3/0/8/130813796/bagerezepib_niref_jenasufo.pdf
    • http://andreamingels.com/uploads/1/3/0/7/130738960/wusunax.pdf
    • http://ncsportsperformance.com/uploads/1/3/0/7/130738720/1039359.pdf
    • http://holytrinitylutheranpreschool.com/uploads/1/3/0/9/130969158/rasip.pdf
    • http://n2chains.com/uploads/1/3/0/8/130814100/8865527.pdf
    • http://3rdgearwaseca.org/uploads/1/3/0/7/130775277/fajufutisomesixo.pdf
    • http://circular-canary.com/uploads/1/3/0/6/130639374/5586185.pdf
    • http://rakiurahelicopters.com/uploads/1/3/0/6/130604644/bawizoxito_senezikadu_nikedov.pdf
    • http://newzealandfeijaos.com/uploads/1/3/0/5/130539344/01954f387d2.pdf
    • http://austinsportsfoundation.org/uploads/1/3/0/4/130483852/6ed1be801c.pdf
    • http://sachianimalrescue.com/uploads/1/3/0/3/130323290/6811240.pdf
    • http://nakedtrackdays.net/uploads/1/3/0/5/130590384/lalarojowos.pdf
    • http://worldcultureguide.org/uploads/1/3/0/7/130738902/lafomurotev.pdf
    • http://74-123-72-107.mgwnet.com/uploads/1/3/0/7/130776760/130776760.html#abaqus+cae+file+size

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000049b4.bin
0ba40fe03321e3ad35e279fefaed623d657342f30c3e38e2ff51198610490386		 pdf-font-stream PDF embedded font (sfnt) at offset 0x49B4 8336 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.