Malicious PDF — malware analysis report

Static analysis result for SHA-256 eef31751d2d817b7…

MALICIOUS

PDF

46.4 KB Authoring application: OpenOffice Draw
MD5: c21366a0e036fb03281c04427e1031f9 SHA-1: bc599cae20c57804ee5ea3aed4a62234a26e21d2 SHA-256: eef31751d2d817b7a77c31dd91f4c0a8100a68fd55beff079319e9ad7b6813f2
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files hosted on various domains, a technique often used for SEO manipulation or to distribute malicious content. ClamAV identified this as Pdf.Phishing.TtraffRobotInstall-7605656-0, and a machine learning model assigned a high probability of maliciousness. The document body is heavily obfuscated and unreadable, providing no direct clues to the specific lure.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cloudiso9001.com/uploads/1/3/0/4/130435972/relirurijiwasutifik.pdf
    • http://www.tiffanyhorticulture.com/uploads/1/3/0/7/130740128/98b4176.pdf
    • http://peoplefollowingjesusworldwide.org/uploads/1/3/0/7/130776344/bedadekibuvowov.pdf
    • http://colormeribbons.com/uploads/1/3/0/2/130288830/bumisevowuliposog.pdf
    • http://insrtagam.com/uploads/1/3/0/2/130272573/witugekisexaf.pdf
    • http://vancouvervideopro.com/uploads/1/3/0/6/130621771/votoxupalatatajexan.pdf
    • http://landforsaleinlafayettecountyms.com/uploads/1/3/0/4/130491488/9efdd3.pdf
    • http://learninator.net/uploads/1/3/0/7/130775840/matakibukobega.pdf
    • http://collectifcontraceptionliege.com/uploads/1/3/0/6/130621387/9336042.pdf
    • http://artiespectorsucks.com/uploads/1/3/0/5/130590163/zoripuvosatekix.pdf
    • http://mississippi-ted.com/uploads/1/3/0/2/130291358/rewaratifo.pdf
    • http://pinellasfootsolutions.com/uploads/1/3/0/6/130620232/1471476.pdf
    • http://www.danielsaline.com/uploads/1/3/0/4/130488506/cd5a51a4975.pdf
    • http://occultaluna.co.uk/uploads/1/3/0/7/130775052/gigapega-kovaduw-sadog.pdf
    • http://reedbailey.net/uploads/1/3/0/8/130874467/vusebudusokeveb.pdf
    • http://257bennettstreet.com/uploads/1/3/0/3/130313088/2744271.pdf
    • http://vinemusicstudio.com/uploads/1/3/0/6/130620555/1e5e10278ca17.pdf
    • http://www.tekq.com.tw/uploads/1/3/0/3/130323329/tudojuk.pdf
    • http://kenichiasai.com/uploads/1/3/0/6/130640200/1710229.pdf
    • http://catscardsandcoffee.com/uploads/1/3/0/7/130739520/wopukeziw.pdf
    • http://mikewilbanks.com/uploads/1/3/0/7/130775983/8326925.pdf
    • http://chocolaticity.net/uploads/1/3/0/7/130738997/2806517.pdf
    • http://logicaasesores.com/uploads/1/3/0/8/130813869/janopisomuveruv.pdf
    • http://courtneyscorner89.com/uploads/1/3/0/6/130604355/jigawopavamape-magafopepapi-wedox.pdf
    • http://chiavantage.com/uploads/1/3/0/2/130288348/eea58beab63009.pdf
    • http://safekidskalamazoo.org/uploads/1/3/0/7/130776174/130776174.html#organiza%C3%A7%C3%A3o+da+administra%C3%A7%C3%A3o+p%C3%BAblica+de+angola+pdf
    • http://mississippi-ted.com/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004e27.bin
7292fe5224e62deef7387b73fd7ba8ac0fb0f93abe20bf9106ef4129193383f2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4E27 10696 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.