Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c76b4c86e25bc5e…

MALICIOUS

PDF

34.7 KB Authoring application: LibreOffice Draw
MD5: 89614a132d28bfa413a38424452dcf94 SHA-1: 91c2874ed5b75d34eef370f924a821d9e42f69c2 SHA-256: 4c76b4c86e25bc5e11459a81d00ea4be9ef1938415f76138c5521eea39847995
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique commonly used in phishing campaigns to redirect users to malicious sites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing classification. No scripts were extracted from this sample, and the document body contained mostly garbled text, making it difficult to ascertain a more specific attack pattern beyond link-based redirection.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mindfulnesslab.centre4innovation.org/uploads/1/3/0/5/130588733/wapijefomomaruk.pdf
    • http://myneosystems.com/uploads/1/3/0/3/130313140/2136880.pdf
    • http://thewhyissue.com/uploads/1/3/0/6/130621351/4444070.pdf
    • http://danaink.org/uploads/1/3/0/6/130639565/aac0b18f12e3a36.pdf
    • http://dinejuneau.com/uploads/1/3/0/6/130620763/wurafereri.pdf
    • http://aspire.ejrp.org/uploads/1/3/0/7/130776647/nojorulelasasova.pdf
    • http://myers-adams.com/uploads/1/3/0/5/130543418/222de95decb.pdf
    • http://trickonecustoms.com/uploads/1/3/0/5/130551512/dejipez.pdf
    • http://taterbucks.com/uploads/1/3/0/6/130639374/xogakij.pdf
    • http://electrotech.vip/uploads/1/3/0/2/130289063/nezana-ruribav-figenizevino-zukop.pdf
    • http://clabsi.com/uploads/1/3/0/7/130775825/wenal-zasofexefivon-xazuvev-zepizajasomoje.pdf
    • http://www.strewthfoods.com/uploads/1/3/0/5/130539676/jeruvifisovuf.pdf
    • http://politicalresearch.net/uploads/1/3/0/2/130270792/wawitakubigazez.pdf
    • http://boldncreative.com/uploads/1/3/0/7/130738796/1783702.pdf
    • http://healthyskinformulacream.com/uploads/1/3/0/5/130540193/rurudunamenotu.pdf
    • http://9oeyv.slpny.com/uploads/1/3/0/3/130323251/130323251.html#congruent+triangles+worksheet+answers+geometry
    • http://clabsi.com/uploads/1/3/0/7/130775825/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002af0.bin
341940d210a3e5f9cda50f18d890734ad75bf79426ae0151ed906ce9acd864e2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2AF0 8504 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.