Malicious PDF — malware analysis report

Static analysis result for SHA-256 f9689361437c2940…

MALICIOUS

PDF

39.8 KB Authoring application: OpenOffice.org
MD5: f94928a1f43cd07a3bf330d91766456a SHA-1: 93fad502cf7d801d7586f16fcbdb9a5f10274ed0 SHA-256: f9689361437c2940e3aa4ce6aa84d5f9e77f5a9481d66ce6c2feb4b7fc5a938c
150 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the ML classifier's high confidence score further support a malicious classification. No scripts were extracted, and the document body was heavily obfuscated, making it difficult to determine a more specific attack pattern beyond link distribution.

Machine Learning

  • Nyx PDF Classifier malicious score 1.0000

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://gisuketasepo.weebly.com/uploads/1/3/0/3/130323738/jasum.pdf
    • http://mycorporateteambuilding.com/uploads/1/3/0/4/130476492/wupovak.pdf
    • http://moonrisetours.com/uploads/1/3/0/6/130620906/903a11d7ec1.pdf
    • https://sotakemuguw.weebly.com/uploads/1/3/0/3/130323400/f5c3e29.pdf
    • http://customlovecandles.com/uploads/1/3/0/6/130604579/tewufad.pdf
    • https://jevasixok.weebly.com/uploads/1/3/0/4/130476573/nuserufi.pdf
    • http://aylesburynaturalburial.com/uploads/1/3/0/6/130621006/fejixupet.pdf
    • http://sportsrt.com/uploads/2020/01/28/kudifesowa_xuvomufaxizole.pdf
    • http://quentonbarn.co.uk/uploads/1/3/0/5/130590395/jeropu_kozorejamefaduj_kunuvikalod.pdf
    • http://desatascosterrassa.com/uploads/1/3/0/2/130291646/pozexufogizizari.pdf
    • http://wyandottespringsurbanfarm.com/uploads/1/3/0/3/130379239/pogol.pdf
    • http://mhscareerservices.weebly.com/uploads/1/3/0/4/130489090/3648800.pdf
    • http://a-timer.com/uploads/2020/01/28/wesuxo-fubeporaza-wobigun-sivexetaga.pdf
    • http://waiapukidshomebased.com/uploads/1/3/0/4/130483577/bofixaxujen-ruxebovevuvof.pdf
    • http://wildomarexpresscarwash.com/uploads/1/3/0/5/130552084/gudagaseka.pdf
    • http://padijike.ethsmart.biz/uploads/2020/01/29/e096c1111ac.pdf
    • http://kristinw.com/uploads/1/3/0/6/130620854/bububajorujorure.pdf
    • http://pawsforacauseinvitational.com/uploads/1/3/0/6/130604020/zaxupovedevunoj.pdf
    • http://nexgentestosterone.com/uploads/1/3/0/3/130379412/347563.pdf
    • http://wildpanzy.com/uploads/1/3/0/6/130604078/8662547.pdf
    • http://magicfoodbus.org/uploads/1/3/0/5/130551019/jimaros.pdf
    • http://theelfbox.com/uploads/1/3/0/6/130621569/130621569.html#powerdyne+supercharger+bd11a

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016b0.bin
3e4c53e26fa6855c45d0cc050f8b9ba1c3411f2d0ea9dc2c2bb82aadf6db4bcd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16B0 9004 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.