Malicious PDF — malware analysis report

Static analysis result for SHA-256 37c149c7076b0538…

MALICIOUS

PDF

38.5 KB Authoring application: OpenOffice.org
MD5: 8b790265a1ae9cb36d56f86d7d4a74bd SHA-1: 6d6c4ddaa19f1a185eb4e4331395c3cd9ce443d1 SHA-256: 37c149c7076b053875b6b58fa31e18d14aa925af99e7ecd625326eaa961264c9
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or malicious redirection intent. The embedded links likely lead to further malicious content or phishing pages.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://chasewindcascadia.com/uploads/1/3/0/2/130272981/a636c23b4d4.pdf
    • http://moot.nilsinternational.org/uploads/1/3/0/3/130379193/a179226595427.pdf
    • http://nationalrealestategroup.org/uploads/1/3/0/5/130550721/1719748.pdf
    • http://wesmarconstructiongroup.com/uploads/1/3/0/6/130639310/kanelanuneze-sasofexuko-dupolikebifi-gigukugidanek.pdf
    • http://lilab.copyrightcontact-1000004839645.com/uploads/2020/01/28/rapidedut.pdf
    • http://wewexamo.sixset.pw/uploads/2020/01/28/19854.pdf
    • http://civilwarlady.org/uploads/1/3/0/2/130271243/jawabuxusimifuvuw.pdf
    • http://christopherbirchmd.com/uploads/1/3/0/2/130291713/tugizizosazoze.pdf
    • https://zafojewun.weebly.com/uploads/1/3/0/2/130289558/liludezozedujorijalu.pdf
    • http://jesikiloju.infonetacademy.tech/uploads/2020/01/27/falipimomipesewe.pdf
    • http://hybrid-cl.com/uploads/1/3/0/6/130621651/73a93d5b551.pdf
    • https://lameturetewov.weebly.com/uploads/1/3/0/5/130550681/361218cca8cb32f.pdf
    • http://dazluq.com/uploads/1/3/0/6/130639712/8111869.pdf
    • https://dikusonum.weebly.com/uploads/1/3/0/5/130588320/gulovitibetux.pdf
    • http://vehicleloanusa.com/uploads/1/3/0/6/130620940/e6c6fa8e5.pdf
    • http://dibap.lobaevammo.com/uploads/2020/01/28/246fd1e54ba.pdf
    • http://nethanelhunting.co.za/uploads/1/3/0/4/130488666/9969ce419f6b.pdf
    • http://monicaariasmiranda.com/uploads/1/3/0/3/130323290/nekasanasikuko_xiniwuri.pdf
    • http://addisonbeaux.com/uploads/1/3/0/3/130379219/pewizuzidaposutu.pdf
    • http://audio-start34.icu/uploads/2020/01/27/8db585ea7b6a.pdf
    • http://lobeziboma.botanicart.ru/uploads/2020/01/28/monesakus-ripevozotida-jafezin-zovatetusalun.pdf
    • http://zambiasafarihunting.com/uploads/1/3/0/4/130491418/130491418.html#watchmen+graphic+novel+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016c4.bin
9945807c60049c67133aa65593df408b574ffa613a9f4aaa13c61e315ec0f5d7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16C4 8108 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.