Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d347c2eeb742cb8…

MALICIOUS

PDF

47.7 KB Authoring application: OpenOffice Draw
MD5: 95dc8f0e0960d4f0bcb38d8f9cbfe35c SHA-1: 9663ff2ca149a81e062be33f45687925e7f97d96 SHA-256: 1d347c2eeb742cb88f7d89772d211af79b413e561894b81b39e035dcbac5149f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent. The document body mentions 'immersive citizens' and provides a link to a change log, but the primary malicious activity appears to be the distribution of numerous PDF files via external links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nextgen-ai.com/immersive-citizens-changes-note/
    • http://edutainmint.com/uploads/1/3/0/4/130489051/nizadume_jaxiw_zumuzunizepolo.pdf
    • http://mrsmoothbeatz.com/uploads/1/3/0/6/130621330/916eb958c1b98.pdf
    • http://omarlattouf.com/uploads/1/3/0/5/130539204/woxeraso-radabas-lidojoxilipife-duvotajuf.pdf
    • http://mywobblyireland.com/uploads/1/3/0/5/130589047/guzevomazoxipirame.pdf
    • http://scienceisfunn.com/uploads/1/3/0/2/130289519/ridozejefuzuger_wiforirij_vigoda_jabab.pdf
    • http://mylighthouselearning.com/uploads/1/3/0/6/130620280/gimeg.pdf
    • http://cephotos.net/uploads/1/3/0/6/130603847/1276142.pdf
    • http://meredithlagerman.org/uploads/1/3/0/3/130323159/9465046.pdf
    • http://rejointz.com/uploads/1/3/0/6/130605074/45d41304c372e.pdf
    • https://kinarokizukimu.weebly.com/uploads/1/3/0/4/130488199/2713773.pdf
    • http://mrhowe.org/uploads/1/3/0/2/130288361/xawatepi.pdf
    • http://theradicallygood.com/uploads/1/3/0/6/130621730/bosikologupotinuw.pdf
    • http://bellalusso.us/uploads/1/3/0/5/130540085/11a1fc20d5acab9.pdf
    • http://sunnydoggrooming.com/uploads/1/3/0/6/130604855/7405725.pdf
    • http://myoffgridpower.com/uploads/1/3/0/6/130603749/givakokisugebumi.pdf
    • http://xelovo.campolasalina.com/uploads/2020/01/28/fd4309163.pdf
    • http://nrttourscentre.com/uploads/1/3/0/4/130436222/599bd06be.pdf
    • http://womensselfdefenseftmyers.com/uploads/1/3/0/6/130605198/66c515.pdf
    • http://mobilityeco.com/uploads/1/3/0/3/130313192/zatozijugud.pdf
    • https://gokavijukiwo.weebly.com/uploads/1/3/0/5/130540146/sajiravopuxatovarug.pdf
    • https://vigotepifo.weebly.com/uploads/1/3/0/5/130589322/zebijudubobe.pdf
    • http://crossconnextion.com/uploads/1/3/0/6/130621473/130621473.html#jk%27s+skyrim+immersive+citizens

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001897.bin
4b091c71a865f4fc8924fff5d6ef588b849bc417d8722d2f68ee5e870d353ed1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1897 8404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.