Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a26fa9d44de9d86…

MALICIOUS

PDF

38.5 KB Authoring application: LibreOffice
MD5: 4106e35b7962d4e99ba3b675c603f59d SHA-1: b61450c30c729243e29f7a8aac8b51a3b95c9c41 SHA-256: 4a26fa9d44de9d866e09e97d2d8c65443376c3b93684ee546afd3a735caf189c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, a technique often used for phishing or distributing further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted, limiting the analysis of direct execution capabilities.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://moovsterrelocation.com/uploads/1/3/0/5/130588468/f05acc1d4117e.pdf
    • http://mazuz.net/uploads/1/3/0/5/130546153/201c7.pdf
    • http://sekolahberpikirindonesia.com/uploads/1/3/0/6/130620194/xolidulewolozub_wewakejabonisi_lolimiv.pdf
    • http://nikosmarinos.com/uploads/1/3/0/3/130313053/4029ff63c3797a.pdf
    • http://sloanemorocco-efolio.com/uploads/1/3/0/6/130604576/6214919.pdf
    • http://new-england-marketing.com/uploads/1/3/0/5/130590689/4440829.pdf
    • http://zcijxeidqtjp.ldihawaii.com/uploads/1/3/0/7/130740048/1705911.pdf
    • http://pers.sjaalmania.nl/uploads/1/3/0/5/130539114/917950a.pdf
    • http://aiaigasa.com/uploads/1/3/0/5/130588799/fokakododa_mojewosamo.pdf
    • http://primpeffect.com/uploads/1/3/0/3/130313186/wogivezobaji.pdf
    • http://nariknektalov.com/uploads/1/3/0/6/130605240/wimutetifuguke.pdf
    • http://not-knapping.com/uploads/1/3/0/2/130289377/6298143.pdf
    • http://www.targethome.it/uploads/1/3/0/7/130739333/5642324.pdf
    • http://rja-designsbyslaglellc.com/uploads/1/3/0/6/130604878/be643e91f9a83.pdf
    • http://zaixiandaxingyouxi.br3h.com/uploads/1/3/0/7/130775263/130775263.html#teaching+grammar+using+games

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003b5a.bin
1a04a563454464dc4dba1cdb9d9eda3558d43f8d3e46c72dc7bc4de672f1a733		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3B5A 8416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.