Malicious PDF — malware analysis report

Static analysis result for SHA-256 26b444b50848d3a9…

MALICIOUS

PDF

41.3 KB Authoring application: OpenOffice.org
MD5: 7e4e135f8e640b83bc284cc521a20129 SHA-1: d2b885fab44cc0b8a38e03b1bbe95231b6a6bcb3 SHA-256: 26b444b50848d3a96956245e0e477fa0a751400e4dc53ef3e0d55830e32c30a2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious classification. The primary attack pattern appears to be a link farm designed to redirect users to potentially malicious content hosted across numerous domains. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chiropractorinscottsdale.com/uploads/1/3/0/7/130738543/9c93aed764c42f9.pdf
    • http://www.vetpadrivers.com/uploads/1/3/0/4/130435781/wefakiburi-mitok.pdf
    • http://webmail.circleoffriendsoregon.org/uploads/1/3/0/7/130775607/5582910.pdf
    • http://mytraining.today/uploads/1/3/0/5/130538986/kinefivi_fevetukekazur_gasifa.pdf
    • http://www.delusionspod.com/uploads/1/3/0/4/130478566/pakenidodinenam.pdf
    • http://goblelaw.com/uploads/1/3/0/4/130435937/mijebu.pdf
    • http://reclaiminghopecounseling.com/uploads/1/3/0/6/130620551/rifibu.pdf
    • http://phrolic.net/uploads/1/3/0/5/130550706/2279102.pdf
    • http://stevenlozada.org/uploads/1/3/0/8/130873781/11442321.pdf
    • http://menfixed.com/uploads/1/3/0/6/130620567/4973b.pdf
    • http://copydemon.com/uploads/1/3/0/7/130739297/bukovunule_wumamo.pdf
    • http://eft4prosperity.com/uploads/1/3/0/6/130604168/3283907.pdf
    • http://www.talk2pei.com/uploads/1/3/0/7/130775023/fb82973be.pdf
    • http://medios21.com/uploads/1/3/0/7/130775905/sakir_xobubaliripe.pdf
    • http://arianabina.com/uploads/1/3/0/6/130620881/dojuke_jumadijezak.pdf
    • http://vega-music-group.com/uploads/1/3/0/7/130738693/8265829c.pdf
    • http://bodysculptorsaustralia.com/uploads/1/3/0/6/130620168/lumafem-ragomari.pdf
    • http://wwiitoday.com/uploads/1/3/0/6/130622042/fewad.pdf
    • http://joyceandcraig.com/uploads/1/3/0/6/130639662/3269100.pdf
    • http://sibtender.net/uploads/1/3/0/6/130621498/mijiwefakujisagizidi.pdf
    • http://icreateec.com/uploads/1/3/0/7/130776692/demozimovukuje.pdf
    • http://www.flashkaboom.hollandskids.org/uploads/1/3/0/6/130621557/dozudobibo.pdf
    • http://beachbumglassshop.com/uploads/1/3/0/4/130435781/5212119.pdf
    • http://jllcapitalmarkets55westmonroe.com/uploads/1/3/0/6/130620819/8244656.pdf
    • http://theelfbox.com/uploads/1/3/0/7/130775378/130775378.html#how+to+combine+pdf+files+without+acrobat+free
    • http://stevenlozada.o

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003e71.bin
c01dccfaf0a854cedb0a4051a77623b3d9c8a9f8c42c5f63c82fa7580cc2f155		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3E71 7932 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.