Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d4f4ac4339aec62…

MALICIOUS

PDF

38.7 KB Authoring application: OpenOffice Draw
MD5: fe66e225385979af261ce9ceb9d2994b SHA-1: 982033885b1641e2a46cb0dcabb73a677dff7f7a SHA-256: 3d4f4ac4339aec6229b5bd54e7ede1f6f3f3879c9da07f0a764a4b3c124f88ac
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute malware. ClamAV identified this sample as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection purpose. The document body is heavily obfuscated and unreadable, preventing a more detailed analysis of its specific lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://motabitoxine.weebly.com/uploads/1/3/0/2/130272610/wunalutokevalofib.pdf
    • http://cccvancouver.com/uploads/1/3/0/5/130539329/311cdd17fef607.pdf
    • http://emilydowlingfriedman.com/uploads/1/3/0/4/130492038/gudixomo.pdf
    • http://nataliemarie.org/uploads/1/3/0/4/130435929/senogizun.pdf
    • http://peldongaming.com/uploads/1/3/0/6/130639110/1578850.pdf
    • http://psrglobal.net/uploads/1/3/0/6/130603942/8d102260134.pdf
    • http://moonlightplanners.com/uploads/1/3/0/2/130288565/133e08c4550b.pdf
    • http://slgmediagroup.com/uploads/1/3/0/6/130620909/jaguratirepimi_bosiluxunaku_damosez_rivadaferasez.pdf
    • https://dabatuzigi.weebly.com/uploads/1/3/0/5/130539768/finenofuwifo_nuromovezajazux_minira.pdf
    • http://catamaranadastra.com/uploads/1/3/0/6/130604986/lozunerumawurenuli.pdf
    • http://countrygirlcocktails.com/uploads/1/3/0/6/130621278/f495e7cd4519.pdf
    • http://xezufureso.globaledumap.org/uploads/2020/01/28/5359866.pdf
    • http://evaairways.org/uploads/1/3/0/2/130270882/zibedifizavej.pdf
    • http://noxawopewi.text-shift.ru/uploads/2020/01/28/funutofewu.pdf
    • http://casemedicine.org/uploads/1/3/0/2/130288507/1026196.pdf
    • http://ccharveyministries.org/uploads/1/3/0/5/130538946/zagogoga.pdf
    • https://wopexisap.weebly.com/uploads/1/3/0/3/130323774/mitalavi.pdf
    • http://samanthawyrick.com/uploads/1/3/0/6/130622013/6907005.pdf
    • http://thehappygirlstore.com/uploads/1/3/0/5/130551206/130551206.html#resign+letter+sample+in+word+format

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000016c9.bin
e7dc76d2de061164c0b3552348dfe18df5e9e24a88a7845a32e7a34ce56b41d1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x16C9 7632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.