Malicious PDF — malware analysis report

Static analysis result for SHA-256 4dd32adf9adb9474…

MALICIOUS

PDF

43.6 KB Authoring application: OpenOffice Draw
MD5: 8971dd324b545bcb4541cb234b8ad23a SHA-1: 5b81edd91d8a7438a6a7b3042f766c0c4d79d7b5 SHA-256: 4dd32adf9adb94747538f973b07102134a7afafb294b8486e2211a979401d936
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains, indicating a link farm designed to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and malicious distribution intent. The document body itself is largely unreadable due to truncation and encoding issues, but the presence of the Maslach Burnout Inventory title suggests a potential lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://fireontheridge.com/uploads/1/3/0/6/130605314/vebav_pokejeretixup_vimegudodum.pdf
    • http://teju.miradorbascamao.com/uploads/2020/01/29/wumib.pdf
    • http://rufukem.csgo-bet.ru/uploads/2020/01/27/lilux.pdf
    • https://juzaxomunidovi.weebly.com/uploads/1/3/0/5/130588675/3810271.pdf
    • http://sizuriz.audiostart07.icu/uploads/2020/01/27/1755168.pdf
    • http://architecturalrenaissancetechniques.com/uploads/1/3/0/4/130435821/8398806.pdf
    • https://xidutivog.weebly.com/uploads/1/3/0/5/130589174/zazovipesasufegovol.pdf
    • http://riverbendoutdoors.com/uploads/1/3/0/5/130590689/130590689.html#the+maslach+burnout+inventory-test+m

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011d7.bin
c8c0394770b5a37a7f7ecde707e5d991b2bce4ad77e3a5e7f179910fa2b0b02c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11D7 8800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.