Malicious PDF — malware analysis report

Static analysis result for SHA-256 b7a15731f6682984…

MALICIOUS

PDF

35.9 KB Authoring application: LibreOffice
MD5: 1464593ba96f3edcd43de3eb055da9dd SHA-1: 757997bba4d8dd9256eb2a7f718a043af2dd962a SHA-256: b7a15731f668298462e2d268c104ce070497214fb17b9e81ebbd25bd6c056c45
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF_SEO_LINK_FARM heuristic indicates a large number of embedded external links, suggesting a link farm or redirection mechanism. ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or malicious traffic generation intent. The document body contains garbled text and appears to be a lure, possibly related to sports rules, but the primary malicious activity is the distribution of numerous links to external PDF files.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://haileysavestheday.com/uploads/1/3/0/5/130545581/73449dbebf11.pdf
    • http://defininggreen.com/uploads/1/3/0/6/130604850/8c84a.pdf
    • http://nofilterbydreah.com/uploads/1/3/0/4/130483412/f42886a53b9057.pdf
    • http://aprendizajeactivobrumiel.com/uploads/1/3/0/5/130540897/8171961.pdf
    • http://mta-sts.mail.laneforward.com/uploads/1/3/0/5/130588461/1126558.pdf
    • http://whackyposts.com/uploads/1/3/0/5/130547275/mejokevosunusim-garepiwi-numeso-mafutoja.pdf
    • http://insiot.org/uploads/1/3/0/5/130539913/2770601.pdf
    • http://pnwfc.com/uploads/1/3/0/4/130483673/gobegizazisepizukijo.pdf
    • http://theatlantadoula.com/uploads/1/3/0/4/130483895/3620729.pdf
    • http://missmillersclassroom.com/uploads/1/3/0/3/130324136/xokujafidetasolen.pdf
    • http://oildaletales.com/uploads/1/3/0/6/130621815/fujoz.pdf
    • http://www.loveempowered.me/uploads/1/3/0/6/130639777/8070674.pdf
    • http://me2007.com/uploads/1/3/0/6/130620747/ad37bb9.pdf
    • http://djournalebydn.com/uploads/1/3/0/4/130483373/pakudorovunov.pdf
    • http://artmat.net/uploads/1/3/0/2/130271099/zeleto-gidipepejet-polevo.pdf
    • http://missteendreamusa.com/uploads/1/3/0/7/130775405/d16dcad.pdf
    • http://lltraininginstitute.net/uploads/1/3/0/6/130620758/vumilogu-xuwafawip-sibuzobukuwi-sixid.pdf
    • http://platypusmarketing.net/uploads/1/3/0/2/130289549/8738613.pdf
    • http://74-123-79-37.mgwnet.com/uploads/1/3/0/3/130379398/130379398.html#nfhs+lacrosse+stick+rules

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000306d.bin
7f004eeb40ccb1be4ce65381ec90fc3f31ea0c6687c009e5e99e2aff29dd5cd2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x306D 7420 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.