Malicious PDF — malware analysis report

Static analysis result for SHA-256 d09d3087080f571a…

MALICIOUS

PDF

38.1 KB Authoring application: OpenOffice Draw
MD5: 9cfbdd885cae4c15c57234858bac3cdc SHA-1: bd2109ed2d869ed8d04d88bcdebb62044fc3b746 SHA-256: d09d3087080f571a8a86c103a96b3a48da8447d91d8057886a8c9bda06a0ebc5
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents, as indicated by the PDF_SEO_LINK_FARM heuristic. The ML classifier and ClamAV also flagged this file as malicious, specifically identifying it as a phishing or traffic-robot-install type. The embedded URLs are likely used to distribute malicious content or manipulate search engine results.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://agilicorp.com/uploads/1/3/0/7/130776865/3832433.pdf
    • http://bdmchallenge.com/uploads/1/3/0/4/130489909/xugosagetubepen.pdf
    • http://shssleep.com/uploads/1/3/0/6/130605036/sobumepereviwixe.pdf
    • http://trustedfinancialpro.com/uploads/1/3/0/5/130551210/rojak-zukeji-xamunune-xinukilugurago.pdf
    • http://moveodancecompany.weebly.com/uploads/1/3/0/5/130550980/41667ec9.pdf
    • http://catamaranadastra.com/uploads/1/3/0/4/130476766/4046160.pdf
    • http://sustainable-smiles.com/uploads/1/3/0/5/130590026/9320266.pdf
    • http://thewomensdefensenetwork.org/uploads/1/3/0/7/130738715/mejofetud.pdf
    • http://bfreshcreative.com/uploads/1/3/0/5/130552053/6926220.pdf
    • http://cafe-kumiko.com/uploads/1/3/0/6/130604801/porarezoxavebavew.pdf
    • http://ja-sauer.family/uploads/1/3/0/4/130490488/2521261.pdf
    • http://susiesbistroandbakery.com/uploads/1/3/0/3/130323972/6983205.pdf
    • http://carlisle-taxi-number.com/uploads/1/3/0/6/130621031/liwetulupagixaxusu.pdf
    • http://101onthe101.com/uploads/1/3/0/5/130544295/5099348.pdf
    • http://5calls.com.au/uploads/1/3/0/3/130323836/toxuge.pdf
    • http://bonkerforbyram.com/uploads/1/3/0/6/130639024/6acbef7462a.pdf
    • http://chitchatchan.com/uploads/1/3/0/5/130551777/4069482.pdf
    • http://staffordchamberofcommerce.com/uploads/1/3/0/5/130588924/30b88ffd.pdf
    • http://michaelmaguire.com.au/uploads/1/3/0/6/130640062/2089409.pdf
    • http://manexpacheco.com/uploads/1/3/0/5/130588268/e143eaf6f.pdf
    • http://atlasthemighty.com/uploads/1/3/0/2/130270740/jokipiborijux-gevoxorutukowu-puzagomaguwi.pdf
    • http://dmc-usmf.com/uploads/1/3/0/6/130639423/sosanupewurif.pdf
    • http://theelfbox.com/uploads/1/3/0/5/130540453/130540453.html#core+workouts+for+back+problems
    • http://bfreshcreative.com/uploads/1/3/0/5/130552053/69262

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000330b.bin
9a4b61785fc144d0b87f46e28669cf990df22b7ea1e0924f442957ea9749aaee		 pdf-font-stream PDF embedded font (sfnt) at offset 0x330B 8164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.