Malicious PDF — malware analysis report

Static analysis result for SHA-256 c16b27254e41dc8d…

MALICIOUS

PDF

48.4 KB Authoring application: OpenOffice.org
MD5: ba70320fa438fe58c4c0d9cb1047e3db SHA-1: ad5d6eba4ad9516557485795bdb11ee371a2a8f6 SHA-256: c16b27254e41dc8d70751b4cb4d586c14d947016d5d4fb6aed712e4788fc632c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique commonly used for SEO spam or phishing campaigns. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier output strongly suggest malicious intent. The primary attack pattern involves redirecting users through a link farm to potentially malicious content.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wickedfreshsalad.com/uploads/1/3/0/5/130588778/dawawepaw.pdf
    • http://newtaiwankonus.com/uploads/1/3/0/5/130588550/fekoduv.pdf
    • http://www.usmilitarynewcarsales.com/uploads/1/3/0/4/130483509/gulebasewekuwo-bakiteg-lugoto-bafaxoxeketu.pdf
    • http://velvetleafglobal.com/uploads/1/3/0/3/130324390/wosogilid.pdf
    • http://kcmwebco.com/uploads/1/3/0/3/130379227/punogesesetogumomo.pdf
    • http://mrsmalloy.com/uploads/1/3/0/7/130740117/mixasevi_simis_lanaset.pdf
    • http://jennycongrave.com/uploads/1/3/0/2/130289295/tewimosewogesetis.pdf
    • http://nickandgraceguy.com/uploads/1/3/0/2/130270901/4371138.pdf
    • http://californiacastaway.com/uploads/1/3/0/8/130814596/2ce535f19c9f0.pdf
    • http://ravenheim.net/uploads/1/3/0/4/130476145/b50a7.pdf
    • http://www.aquaticmanagementsystems.com/uploads/1/3/0/2/130289496/xijefuruw.pdf
    • http://momstoybox.com/uploads/1/3/0/7/130739662/9865094.pdf
    • http://bellanetfiber.net/uploads/1/3/0/7/130738870/d3fe5affc13fc.pdf
    • http://invrnc.net/uploads/1/3/0/5/130589261/f9d022a.pdf
    • http://cleanupga.org/uploads/1/3/0/7/130738882/kutojuwupijosi-rizowaw.pdf
    • http://storyspinner.net/uploads/1/3/0/4/130476427/zimaleteriko-jilunujabak.pdf
    • http://smallbusinesswebdesign.company/uploads/1/3/0/6/130640025/6637253.pdf
    • http://brakeactive.com/uploads/1/3/0/5/130589315/130589315.html#adobe+acrobat+distiller+9+full+version+free+download

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000309e.bin
fd22af53f2844f775e2788e663f76d51cbd1f673c8a6c692d2e507cbfd993ddd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x309E 6544 bytes
font_01_sfnt_off00004523.bin
d8fa1d180e0a505d0c2b16a5f695b88c8b58e4db502161fc5572c07a7daa196e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4523 16488 bytes
font_02_sfnt_off00005eb9.bin
739db808a786f7119e710450183a34a0fa992ef6b384f25ea81e6b842431b50e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5EB9 9176 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.