Malicious PDF — malware analysis report

Static analysis result for SHA-256 3cd50ef4d66a24fe…

MALICIOUS

PDF

38.7 KB Authoring application: LibreOffice Draw
MD5: 4a8e096047ed78c91fa5696ba2585f76 SHA-1: dcc774e4fa62ec8a58a0ffe87bd6062aba6c0d46 SHA-256: 3cd50ef4d66a24fe1c8bcababb1ea841b4ca16ba93db09e082cb5a4d02af82c1
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This technique, identified as PDF_SEO_LINK_FARM, is commonly used to distribute phishing content or redirect users to malicious sites. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports the malicious nature of this file. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://oacmedicalspa.ca/uploads/1/3/0/4/130475996/6a58768830d.pdf
    • http://componentcatalog.dev/uploads/1/3/0/7/130739711/4610718.pdf
    • http://rlsadvisors.com/uploads/1/3/0/8/130813762/difereludiful_deziwesaxupepag.pdf
    • http://www.shuttleescalante.com/uploads/1/3/0/6/130620326/31300722002947.pdf
    • http://collinyearry.com/uploads/1/3/0/7/130738969/c1963ccfa.pdf
    • http://www.discoveryelectricbikes.com/uploads/1/3/0/5/130590122/85c310.pdf
    • http://wizardways.com/uploads/1/3/0/8/130815115/bufeta.pdf
    • http://yorkshiredigitalconsulting.com/uploads/1/3/0/3/130324011/fe832d179c8.pdf
    • http://acaringpregnancy.com/uploads/1/3/0/7/130776299/7026700.pdf
    • http://katherinemhowellsoprano.com/uploads/1/3/0/7/130739200/4347e08e29c81d.pdf
    • http://cchristensenphoto.com/uploads/1/3/0/6/130620985/mibefomibuf.pdf
    • http://melatonindreams.com/uploads/1/3/0/6/130639632/4358290.pdf
    • http://cookielovecustomsugarcookies.com/uploads/1/3/0/5/130538986/b0f6b647afcd35c.pdf
    • http://gettruckquote.com/uploads/1/3/0/7/130776159/5012328.pdf
    • http://kristamalia.com/uploads/1/3/0/4/130476657/vixosowava.pdf
    • http://oddher.com/uploads/1/3/0/6/130621597/9b8dd2537a2.pdf
    • http://rechargedxb.com/uploads/1/3/0/6/130603811/e11bffafd310.pdf
    • http://mmchughartworks.com/uploads/1/3/0/6/130621503/1573738.pdf
    • http://rpluscreativesmy.com/uploads/1/3/0/6/130639656/vujujilejav_gibagenuponen_powuloted.pdf
    • http://southamericarealstate.com/uploads/1/3/0/4/130491008/kudebawobawewig.pdf
    • http://paigeleandraphotography.com/uploads/1/3/0/5/130589223/juwivo-gajovazizuto-wisewedigu-ledorafumeri.pdf
    • http://volunteerfocus.com/uploads/1/3/0/3/130323362/7761976.pdf
    • http://onlocation-sh.com/uploads/1/3/0/2/130289377/fafolunawabobix_nidutuzuboku_moliwi_leretaleta.pdf
    • http://getpaidlikewayland.com/uploads/1/3/0/5/130551176/dizebozifutoxisulu.pdf
    • http://barringtonhotel.devsite-1.com/uploads/1/3/0/8/130874127/130874127.html#what+is+an+alkaline+phosphatase+blood+test+for
    • http://cookielovecustomsugarcookies.com

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033c9.bin
1cd066fae03806c6b602f34b34074207c1f6dad8cb9a320850cdbe60f1122729		 pdf-font-stream PDF embedded font (sfnt) at offset 0x33C9 7856 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.