Malicious PDF — malware analysis report

Static analysis result for SHA-256 4702cebc29453baf…

MALICIOUS

PDF

50.6 KB Authoring application: OpenOffice Draw
MD5: 81b2a0c12d4d758af47654d6efe41cc5 SHA-1: 90d99b8938a24632d49d099786c0b7bbbe02b465 SHA-256: 4702cebc29453baf50088b10ef8cb540c177195053f1287c8a44109c11ab9999
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected as malicious by ClamAV with the signature Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a large number of embedded external links, characteristic of a link farm used for phishing or malware distribution. The document body contains garbled text and a list of URLs, reinforcing the finding of a link farm.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://votened.net/uploads/1/3/0/5/130589360/xusofud-xovisidixari.pdf
    • http://courtneyfiles.com/uploads/1/3/0/5/130589160/5294263.pdf
    • https://mefemagu.weebly.com/uploads/1/3/0/5/130540366/cc97b91b99d3e1.pdf
    • http://proficiencyfirst.org/uploads/1/3/0/5/130543640/91430.pdf
    • http://kexoze.tovarug.icu/uploads/2020/01/27/05736c1b9c80.pdf
    • http://voxor.olikx.xyz/uploads/2020/01/29/0c692.pdf
    • http://ancestreemusic.com/uploads/1/3/0/5/130590550/ab17b3c7.pdf
    • http://mountainandwaterstudio.com/uploads/1/3/0/6/130604497/webiwuvesomux.pdf
    • http://powertospeaknaked.com/uploads/1/3/0/2/130291471/28d053c936d9.pdf
    • http://rayonlifestyle.com/uploads/1/3/0/5/130540405/53b37e5f166e1e.pdf
    • http://kidskeepcharlestonclean.org/uploads/1/3/0/5/130540461/nivikatufuzedez-xunenezujikud-kutexi.pdf
    • http://iloveacorns.com/uploads/1/3/0/4/130476204/zomitojubuzok.pdf
    • http://a1creativecoatingsolutions.com/uploads/1/3/0/5/130550752/0e410885.pdf
    • http://5pointauto.com/uploads/1/3/0/5/130551115/130551115.html#bajrang+bali+dj+naa+song

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001366.bin
d311f8a56e85594c49c1df357f17db406e6855e104af0b733479635d8c91b48c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1366 7940 bytes
font_01_sfnt_off0000584d.bin
16374c43fefb3fb406266acbe16aee7d7122405634c1b68ba02c6c95ae4378ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x584D 4196 bytes
font_02_sfnt_off000064fd.bin
d60e2eb62e2a9765a1c86d97aa356a395f69e1f52e6372c90c7944723fa29a8c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x64FD 16064 bytes
font_03_sfnt_off00007a3d.bin
01b5d47708c0fff66d32a9a36fde738ea4f2cabb81cdf5e9d1d93311cba18bb1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7A3D 9632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.