Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d973d2489986733…

MALICIOUS

PDF

36.2 KB Authoring application: LibreOffice
MD5: 75d76ca9ae1c0327931a5262a49cb144 SHA-1: 3e10c3c8ef495fcfd7289d475dc819d1f043f49d SHA-256: 1d973d2489986733a99af95da38b447d2718e0218cc3946331eb24f8bf694b2f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files hosted on various domains. This is indicative of a phishing or content-luring campaign. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports this assessment. The embedded URLs are the primary IOCs.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://patelchiro.com/uploads/1/3/0/6/130604739/1670377.pdf
    • http://alliesonthejourney.com/uploads/1/3/0/6/130621352/pigibu.pdf
    • http://tecnologikasistenciatecnica.com/uploads/1/3/0/9/130969888/6403858.pdf
    • http://finditwithease.com/uploads/1/3/0/2/130287502/pugokigigakusi.pdf
    • http://comercializadoralm.com/uploads/1/3/0/5/130590158/bawolijufurewo-vimalaribopeg-wikufigapix-weriwibop.pdf
    • http://www.katrikoivisto.com/uploads/1/3/0/4/130435583/8495699.pdf
    • http://74-123-76-50.mgwnet.com/uploads/1/3/0/4/130476691/jokefuposutezot-lidiwofumuze-sigan.pdf
    • http://gesund24.blog/uploads/1/3/0/3/130324234/bekixura.pdf
    • http://bestcosmeticplasticsurgery.com/uploads/1/3/0/4/130483924/lomovopufisamuk_regemixula_wedelere_gavudogap.pdf
    • http://horsetemplates.com/uploads/1/3/0/5/130547846/dazipuj.pdf
    • http://larkspurlanelandscapes.com/uploads/1/3/0/4/130436165/gatejedotananuti.pdf
    • http://phatbottomspray.com/uploads/1/3/0/6/130620451/2216371.pdf
    • http://remade.info/uploads/1/3/0/7/130775795/fusewixijomixe.pdf
    • http://thoughtsandimpressions.org/uploads/1/3/0/8/130813730/9132aa.pdf
    • http://thel14.com/uploads/1/3/0/6/130620372/d2157a1b3526be.pdf
    • http://banchanfood.com/uploads/1/3/0/4/130477146/xamupet.pdf
    • http://adidasdeadstockmarketplace.com/uploads/1/3/0/2/130289185/5456434.pdf
    • http://autodiscover.infinityinspector.com/uploads/1/3/0/7/130738917/tanidul_wovaraletu.pdf
    • http://djsacademy.com/uploads/1/3/0/7/130740401/130740401.html#the+furies+summary
    • http://banchanfood.com/uploads/1/3/0/4/130477146/x

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000031b6.bin
4be520c3f2aedfb647962d51e6c55abd9bdea0c700dda3096392f080e152bebe		 pdf-font-stream PDF embedded font (sfnt) at offset 0x31B6 7236 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.