Malicious PDF — malware analysis report

Static analysis result for SHA-256 3fefbdcf9c9221b4…

MALICIOUS

PDF

32.8 KB Authoring application: OpenOffice.org
MD5: 413b9851c541772d998fc94be7e1d7ac SHA-1: 8b6b0baf26181da8046a5613efd4dccd91a2729c SHA-256: 3fefbdcf9c9221b4aa00ccbef44a8d0afecde3cc1e8f30a86920f71892426a21
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files, a technique commonly used in SEO poisoning and phishing campaigns to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports this assessment. The document body, though heavily corrupted, contains fragments of URLs and text that align with a phishing or malicious download lure. No scripts were extracted from this sample.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mhfacilities.com/uploads/1/3/0/2/130287371/xegomavexenase.pdf
    • http://questdjs.com/uploads/1/3/0/5/130588220/c5b7627aaff2d6.pdf
    • http://theacoustictrio.net/uploads/1/3/0/2/130270889/8727351.pdf
    • http://natureallbody4ever.com/uploads/1/3/0/6/130604807/e30d96f8286090c.pdf
    • http://nakedpavementbooks.com/uploads/1/3/0/4/130483940/tudozipera_nawemizazuj_piwoxeneworul.pdf
    • http://www.steelcityathletics.com/uploads/1/3/0/5/130589146/jemuwuxotoludexojeru.pdf
    • http://www.paradisecountrycockers.com/uploads/1/3/0/5/130539849/zinokorezotunulizo.pdf
    • http://treper.se/uploads/1/3/0/3/130313021/kewejujopipemunewob.pdf
    • http://school-playground-equipment.com/uploads/1/3/0/5/130589007/4134873.pdf
    • http://magicklymodern.shop/uploads/1/3/0/8/130874601/2dbce3e698.pdf
    • http://www.drivingsalesblog.com/uploads/1/3/0/2/130288301/kiwixuxinub-libudafefivo-defovinidigun-fexinaxibow.pdf
    • http://northbayjudoclub.com/uploads/1/3/0/6/130622095/fexatuki-vunukozepebeni.pdf
    • http://dhi-nc.com/uploads/1/3/0/2/130291724/128d9.pdf
    • http://woodlandstuition.com/uploads/1/3/0/8/130813869/130813869.html#verbs+with+prepositions+exercise+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002772.bin
11d4996e3774f7cac90daf715995740831c7fc2ad50a5d6071d4a4e8b4f43b9d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2772 7716 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.