Malicious PDF — malware analysis report

Static analysis result for SHA-256 b58370d02573417c…

MALICIOUS

PDF

45.7 KB Authoring application: OpenOffice Draw
MD5: 0b82b972d81f58ac17d94d7f57b11e75 SHA-1: c82bdcc454f238b4d899e38462c70dad1c669176 SHA-256: b58370d02573417ced4a597249e06221d56baa83359464bcbf622cf109e44fdf
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF document was flagged by multiple heuristics as malicious, including a critical finding for a link farm containing 31 external PDF links. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. The document body is heavily obfuscated and unreadable, providing no direct clues to its purpose beyond the embedded link farm.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9994

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.spiritwordtable.com/uploads/1/3/0/8/130813769/7584694.pdf
    • http://celerigen.com/uploads/1/3/0/6/130605357/fefawofirusebi-belopesidonaveb.pdf
    • http://muzo-emerald.net/uploads/1/3/0/5/130588268/satad.pdf
    • http://spcwelding.com/uploads/1/3/0/5/130588191/2137496.pdf
    • http://androidbyexample.com/uploads/1/3/0/5/130589085/lunivuj.pdf
    • http://fetalcardio.org/uploads/1/3/0/6/130639054/248f9d5.pdf
    • http://tonibrannan.com/uploads/1/3/0/5/130539128/gawuja-wudopuga-lonidi.pdf
    • http://thechrischapman.com/uploads/1/3/0/5/130543107/7856598.pdf
    • http://bestbefrank.com/uploads/1/3/0/6/130620543/sisofubuwif.pdf
    • http://info.delovenhof.nl/uploads/1/3/0/2/130287513/6c8c9e150984d51.pdf
    • http://stickfigcards.com/uploads/1/3/0/2/130288639/lobuvamubisuda.pdf
    • http://bellevueboysswive.com/uploads/1/3/0/5/130589409/goboxew_lejuzoxipu.pdf
    • http://baycoreconsulting.com/uploads/1/3/0/6/130640048/nuwupejotedenigez.pdf
    • http://e-performancetahiti.com/uploads/1/3/0/5/130546385/1715da0.pdf
    • http://mta-sts.sumacdesign.com/uploads/1/3/0/8/130813577/rekalituk_rorenesetefa_zemevuroloras_wapanaxilelex.pdf
    • http://mail.goldenehausnummer.com/uploads/1/3/0/3/130313198/99828.pdf
    • http://tor.money/uploads/1/3/0/7/130776639/goliponib_lidoxeb.pdf
    • http://fishtalesoup.com/uploads/1/3/0/5/130588202/kopikazoja.pdf
    • http://www.mobile.streetsmartyouthproject.org/uploads/1/3/0/5/130545573/kizerip_jisenuvi.pdf
    • http://hatchreno.com/uploads/1/3/0/4/130483983/aadf9c566968.pdf
    • http://regencymorgans.net/uploads/1/3/0/6/130621357/1747232.pdf
    • http://queenalexandra78ave.com/uploads/1/3/0/5/130551941/5557954.pdf
    • http://radioevasi.com/uploads/1/3/0/7/130738949/e6116f.pdf
    • http://restauracjaureni.pl/uploads/1/3/0/4/130476525/130476525.html#adobe+illustrator+cs6+hintergrund+transparent

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004481.bin
41d5c9cb4d60b7530e3cfd93a78efd430fe179aa57a8296e74fb8a971da4b0ee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4481 2600 bytes
font_01_sfnt_off00005026.bin
62b995ad2795364dff0933adad4d3d024509b0afbd02358b338cc70e9fb8b35a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5026 8080 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.