Malicious PDF — malware analysis report

Static analysis result for SHA-256 391b28132905d48f…

MALICIOUS

PDF

33.4 KB Authoring application: OpenOffice Draw
MD5: 9610155afdbda1e2121c320462a96ec3 SHA-1: 3c7c9cf97fd4ef9d8ee5bea630fd49750a78f184 SHA-256: 391b28132905d48f8f097a04a67f2925e02217ef751dcb2d098cd73eb8ce30b1
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF contains an embedded JavaScript stream and a large number of external links, indicating a phishing or redirection attempt. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this, suggesting the file is part of a traffic redirection or phishing campaign. The embedded JavaScript likely facilitates the redirection to the listed URLs.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://danyellscakesandcreations.com/uploads/1/3/0/6/130639658/vopuvigur.pdf
    • http://soundslikesilence.net/uploads/1/3/0/5/130541743/5266992.pdf
    • http://naturalproducts.shop/uploads/1/3/0/5/130541133/komoliko.pdf
    • http://msaimports.com/uploads/1/3/0/6/130605222/378773c3070679c.pdf
    • http://alwaysgq.net/uploads/1/3/0/2/130289577/farutumusuxulo.pdf
    • http://das.nsuxa.net/uploads/2020/01/28/besur.pdf
    • http://2051551albertaltd.com/uploads/1/3/0/5/130589338/7cd20fccb6.pdf
    • http://myedmontonaccountants.com/uploads/1/3/0/7/130739037/130739037.html#o+menino+de+pijama+listrado

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001119.bin
ea83919458f9b1db381bc9908a15d6f41b973b28105018301b340024865a66d4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1119 9128 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.