Malicious PDF — malware analysis report

Static analysis result for SHA-256 da067ec2530284e2…

MALICIOUS

PDF

46.9 KB Authoring application: OpenOffice.org
MD5: fa5ea72a7a659e9b550bcbd3d5b48cc0 SHA-1: 92ff7c315638e5159bf1a15f091f8c77ca500b07 SHA-256: da067ec2530284e27a214cf38671551b4fc5c96306578e4d8b427dc9be466aa6
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to host phishing content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier strongly indicate malicious intent. The document body itself is heavily obfuscated and does not provide clear user-facing text, but the heuristic firings are sufficient to determine the attack pattern.

Machine Learning

  • Nyx PDF Classifier malicious score 0.9998

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://koolcompanies.com/uploads/1/3/0/5/130547527/3396129.pdf
    • http://supremedoorsblindsandshutters.com/uploads/1/3/0/2/130289063/4477002.pdf
    • http://drashcraft.com/uploads/1/3/0/6/130604580/mibivamopika_naxowi.pdf
    • http://partyuniversity.org/uploads/1/3/0/8/130814439/822310.pdf
    • http://www.mayatcrawford.com/uploads/1/3/0/4/130476519/lusoma.pdf
    • http://xinhaoboyayulechengguanfangwangzhan.br3h.com/uploads/1/3/0/4/130435635/5953510.pdf
    • http://cloud-token-info.com/uploads/1/3/0/6/130604022/7871afd068a0a2.pdf
    • http://luvschool.com/uploads/1/3/0/5/130550704/0023ec117c.pdf
    • http://landofosllc.net/uploads/1/3/0/5/130540567/6352518.pdf
    • http://newtampafootandankle.net/uploads/1/3/0/6/130603832/gavavekolemirebide.pdf
    • http://deadseaimports.com/uploads/1/3/0/5/130588508/xibefapiw_davexajapo_jidulepivofu.pdf
    • http://www.chameleonhypnosis.com/uploads/1/3/0/7/130738710/fifagekumor.pdf
    • http://mineolatrading.com/uploads/1/3/0/6/130621084/ad303109.pdf
    • http://megadethslot.com/uploads/1/3/0/5/130589409/7906831.pdf
    • http://kaukauproductions.com/uploads/1/3/0/2/130271038/3d5360e912bdc.pdf
    • http://bsmithcontracting.com/uploads/1/3/0/2/130287279/sabaw.pdf
    • http://toledomarineservice.com/uploads/1/3/0/4/130489969/7fa4ab.pdf
    • http://texasplanetsub.com/uploads/1/3/0/6/130621569/d3422a5d.pdf
    • http://catyoung.net/uploads/1/3/0/5/130551434/f5ef206.pdf
    • http://betstreamsp.com/uploads/1/3/0/4/130488701/rivajixibaweganun.pdf
    • http://trudera.net/uploads/1/3/0/5/130539300/robupigekujave.pdf
    • http://brainstemtumorlady.com/uploads/1/3/0/2/130288571/zuruzi.pdf
    • http://jke.brdge.org/uploads/1/3/0/6/130639608/130639608.html#how+do+i+split+a+pdf+file+into+multiple+pages

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000047d1.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x47D1 2652 bytes
font_01_sfnt_off00005431.bin
f198ba360a88689d45646150b2afddc22aef7dd399cefd8ad6418744d64471f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5431 8644 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.