Malicious PDF — malware analysis report

Static analysis result for SHA-256 b65e8a59ed363b56…

MALICIOUS

PDF

59.5 KB Authoring application: LibreOffice Draw
MD5: 162d9b51ac86a51854c911cd67ccf81e SHA-1: 14b8a5e8f1b7eeda76da84ea6691c36ebe1303dc SHA-256: b65e8a59ed363b5614dbd21b2959dd92b738a4555ebdc32df92e5efea2032e9c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

This PDF document contains a large number of embedded links to other PDF files, a technique commonly used for SEO poisoning or to distribute malicious content. The document body, though heavily obfuscated, contains references to a 'Briggs and Stratton 1150 snow blower manual' and includes numerous URLs pointing to PDF files hosted on various domains. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly indicate malicious intent, likely to lure users into downloading further malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9999

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pisec.org/uploads/1/3/0/6/130604226/mutama.pdf
    • http://mollytriplettphotography.com/uploads/1/3/0/4/130491594/b3189654bfa.pdf
    • http://kristiepottertherapy.com/uploads/1/3/0/6/130621483/7556520.pdf
    • http://sazani.rucoolcash.xyz/uploads/2020/01/28/3810333.pdf
    • http://josephturyatemba.com/uploads/1/3/0/6/130621215/rudovu.pdf
    • http://mrchadleypw.ca/uploads/1/3/0/5/130550814/wevuweze.pdf
    • http://weltziensong.com/uploads/1/3/0/2/130289597/d7f8f2090afa.pdf
    • http://asapusedcars.com/uploads/1/3/0/2/130289246/gosuxive.pdf
    • http://bostontangofestival.org/uploads/1/3/0/4/130435548/2bae0dbd3cfd492.pdf
    • http://legacytaxidermy.net/uploads/1/3/0/5/130546574/gozikotifigej_tobegute_zitoboram_lebudifevifa.pdf
    • http://mikewrong.com/uploads/1/3/0/2/130289344/0a4f79e.pdf
    • http://advance-it.net/uploads/1/3/0/6/130621941/130621941.html#briggs+and+stratton+1150+snow+blower+manual

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001076.bin
b5333e6c4f98fecc5d8eb1d58c6077ab4ea6f501883947601eb139560116cec9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1076 8536 bytes
font_01_sfnt_off000099ac.bin
669a22844ddb84b64a1d93eb6147c2b8b7ca76f4316fe4be2bbf69c96252e72a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x99AC 16180 bytes
font_02_sfnt_off0000ae8b.bin
d907c570f1f8f2d62f38d7529dbf77de46ca3a1917ec53aca7a78bae59874b04		 pdf-font-stream PDF embedded font (sfnt) at offset 0xAE8B 2616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.