Malicious PDF — malware analysis report

Static analysis result for SHA-256 e9063f3243cfaf76…

MALICIOUS

PDF

46.6 KB Authoring application: OpenOffice.org
MD5: d356929877ec5195f9d51a01e902a179 SHA-1: ead831905ec60fafced0bfc70dcef09dcd015e29 SHA-256: e9063f3243cfaf76bd1c1428d9ef9b8b01cddaa32b68d59369db0d11e4e2ef76
190 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links, many of which point to external PDF files on suspicious domains. The ML classifier and ClamAV detection strongly indicate malicious intent, likely for phishing or malware distribution. The document body, though heavily truncated, appears to be a lure related to 'Animal Farm' to entice clicks on these links.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Image-heavy PDF with invisible link to suspicious domain high PDF_SUSPICIOUS_LINK_LURE
    PDF is a small image-heavy lure with invisible link annotations that send the user to a suspicious high-risk-domain URI. This matches credential-phishing carriers where the visible document is only a prompt and the real collection flow happens on the linked website.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://terapiaregresiva.org/uploads/1/3/0/5/130589328/2120218.pdf
    • http://medrounds.net/uploads/1/3/0/6/130603853/zatosejumikinuk.pdf
    • http://murraystrainingservces.com/uploads/1/3/0/5/130590663/d0712c363547bcd.pdf
    • http://birminghamreformed.org/uploads/1/3/0/4/130476078/fifiwuvolor_vufivunolajof_bobujedu.pdf
    • http://hostmaster.rogertewierikefotografie.nl/uploads/1/3/0/6/130605078/luzes.pdf
    • http://ssl-general.sslcommunity.com/uploads/1/3/0/3/130323384/zafised_redipa.pdf
    • http://masonicformation.net/uploads/1/3/0/2/130288552/678414.pdf
    • http://onlocation-sh.com/uploads/1/3/0/6/130604858/gixov.pdf
    • http://www.equinediagnostic.com/uploads/1/3/0/9/130969294/18edb.pdf
    • http://onlinesecurityservice.site/uploads/1/3/0/6/130639426/4113696.pdf
    • http://newleaftv.com/uploads/1/3/0/6/130639904/9560184.pdf
    • http://randynazarian.com/uploads/1/3/0/4/130489351/levafakuji.pdf
    • http://hostmaster.under--17--driving--lessons.co.uk/uploads/1/3/0/5/130543092/tijubelokesugejej.pdf
    • http://hib.365roadsideassist.com.au/uploads/1/3/0/6/130603737/juxebasopanola.pdf
    • http://mta-sts.mail.agility.at/uploads/1/3/0/7/130775374/6ffe2c4c27eae66.pdf
    • http://bhcontractingok.com/uploads/1/3/0/5/130539393/nexafagisol.pdf
    • http://tnblistecadeau.ca/uploads/1/3/0/5/130543667/3327114.pdf
    • http://travelinalong.voyagerwebsites.com/uploads/1/3/0/9/130969796/130969796.html#animal+farm+summary+chapter+1-6
    • http://hostmaster.rogertewierikefotografie.nl/uploads/1/3/0/6/130605078/luzes

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005a90.bin
7e6a242d51c1133681a1d483fdb2f61c1ee8bfef99df4ad53d5d445cfae83d80		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5A90 7852 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.