Malicious PDF — malware analysis report

Static analysis result for SHA-256 34ae1d9b8a7d6df0…

MALICIOUS

PDF

39.1 KB Authoring application: OpenOffice.org
MD5: 93931a0e43bc2974f18801b096ef20e9 SHA-1: e72b7d49f5a30622b92f11759f7ccd2dfcb9b7a0 SHA-256: 34ae1d9b8a7d6df05ed78a155d2f26da0afd42a3401e886d0915904733f6133b
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to various domains. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent. The embedded document body text, though corrupted, mentions 'Airtel music video', suggesting a lure or distraction. The primary attack pattern involves redirecting users to these external URLs, which likely host phishing content or further malware.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://scahistoricalsociety.com/uploads/1/3/0/5/130543546/9031966.pdf
    • http://ourladywillowbrook.com/uploads/1/3/0/5/130551876/liwuxonozunizi-semij-lugep.pdf
    • http://mxrkz.com/uploads/1/3/0/6/130639173/zepebex.pdf
    • http://milwaukeesfavoritedj.com/uploads/1/3/0/6/130621033/dazunadijol_bokenagufakizu_dujaneminodiru.pdf
    • http://soul-sunshine.com/uploads/1/3/0/6/130621321/ce0e89f.pdf
    • http://merryvillemuseum.com/uploads/1/3/0/6/130620232/777f763ad0f6c.pdf
    • http://natashabentley.co.uk/uploads/1/3/0/6/130621815/3f70d.pdf
    • http://dofnelsonfaithfomation.com/uploads/1/3/0/2/130291922/631c8.pdf
    • http://mynaturalhairspa.com/uploads/1/3/0/6/130639025/130639025.html#airtel+music++video

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011a0.bin
9e2b6361b54e10c9cda2ea9a68658832a7753bc8adbcec6215a30c8b19f02ee7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11A0 7968 bytes
font_01_sfnt_off00004f11.bin
3239816e96039b5bc7f570846a0bb577d2b46c886e9bacd4e00b5647c5988192		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4F11 8908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.