Malicious PDF — malware analysis report

Static analysis result for SHA-256 43be01b45b4162e8…

MALICIOUS

PDF

47.5 KB Authoring application: LibreOffice
MD5: 8f9306f70c63af53e2dda3351cb373c4 SHA-1: b516b9859bac2a140c814b353040497969c739d1 SHA-256: 43be01b45b4162e820e127b57dbceeee0fb0fc68fb96101e990a4c4d7ecb47b1
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, many of which point to other PDF files hosted on various domains. The document body text, despite being heavily obfuscated, mentions a 'hidden voice recorder for android phone' and includes several URLs. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or malicious redirection campaign. The primary attack pattern involves luring users to download further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bullfrogs-butterflies.com/uploads/1/3/0/6/130604821/vogotabame-mikusajojemik-joxibopawamuwok.pdf
    • https://biwewenolofosok.weebly.com/uploads/1/3/0/5/130551311/budojozaf.pdf
    • http://cawatercareers.com/uploads/1/3/0/5/130544703/kutudew_purepuxorugewi_muviselobev_bodidezi.pdf
    • http://newflavorhouseinc.com/uploads/1/3/0/5/130588618/xakoto.pdf
    • http://susafis.hlfxdata.online/uploads/2020/01/29/gurut.pdf
    • http://acufirstchoice.com/uploads/1/3/0/5/130547515/5954999.pdf
    • http://holochainers.com/uploads/1/3/0/6/130621480/lojafokej.pdf
    • http://nlpcoursesmelbourne.com/uploads/1/3/0/2/130288533/ebf6a61ca57da78.pdf
    • http://foothillsbiblefellowship.com/uploads/1/3/0/6/130604077/130604077.html#hidden+voice+recorder+for+android+phone

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001223.bin
6f5b3b5502e1c582319d20491a5de534c040a29f784f44ed3621c669edbe249f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1223 8092 bytes
font_01_sfnt_off00006b00.bin
805e4be4fa1936fc2df3120f1db1d07b4222899cb0fb84c4d3d937e3d57c1a0b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6B00 18916 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.