Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e15333dd8b91ed1…

MALICIOUS

PDF

44.1 KB Authoring application: LibreOffice Draw
MD5: 8ed1c8c95e9995aa865277d61566b78f SHA-1: c11e5000cbe835255a5aa75236c3292d48dc4887 SHA-256: 4e15333dd8b91ed1de15d49ae070bb7d10441a5d98c90cd984e313ebdf337370
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links to other PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection motive. The document body, though containing garbled text, mentions 'Descargar manga de akame ga kill pdf mega', suggesting a lure to download content related to popular media to mask the malicious intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gowlands.com/uploads/1/3/0/7/130738673/wixegi.pdf
    • http://www.sparklyhealthandlove.com/uploads/1/3/0/4/130478347/8398267.pdf
    • http://mooretre.com/uploads/1/3/0/6/130621321/4b01f279dc3f210.pdf
    • http://waitakaruruschool.com/uploads/1/3/0/7/130739167/6cb35f7ddee.pdf
    • http://loneezyvisionz.com/uploads/1/3/0/7/130776133/e9cd3.pdf
    • http://rangerlab.com/uploads/1/3/0/7/130776847/11dabe2d8.pdf
    • http://mail.idealpersonality.com/uploads/1/3/0/6/130621100/39e32ff.pdf
    • http://bubblebagsaustralia.com/uploads/1/3/0/8/130873939/cbcf9.pdf
    • http://rootedsunshinetraining.com/uploads/1/3/0/4/130476572/2d5a0e5.pdf
    • http://africanubuntusafaris.com/uploads/1/3/0/6/130603763/75c2c1.pdf
    • http://nscrlongisland.com/uploads/1/3/0/2/130274169/3b817199d2.pdf
    • http://salov.org/uploads/1/3/0/5/130551554/4896402.pdf
    • http://spritzglitter.com/uploads/1/3/0/5/130589218/4090337.pdf
    • http://nutritionwithnahla.net/uploads/1/3/0/3/130324451/kanozujezefisit_sozag.pdf
    • http://www.rynesfamily.com/uploads/1/3/0/7/130775376/zuxajujili.pdf
    • http://uvirtualcare.com/uploads/1/3/0/7/130739278/bfebf88ea776c1.pdf
    • http://74-123-76-228.mgwnet.com/uploads/1/3/0/5/130551087/130551087.html#descargar+manga+de+akame+ga+kill+pdf+mega
    • http://mooretre.com/uploads/1/3/0/6/130621321/4b01f2

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f39.bin
43f49b32ef54c55747debf4b7985a34df8afd4b0407b025471b138375e28e345		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F39 5688 bytes
font_01_sfnt_off00004670.bin
3db6a34e866de906c7b8aff83ef76ac78e82ce23ed7fd0ae1d0b57aca07a3d33		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4670 13732 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.