Malicious PDF — malware analysis report

Static analysis result for SHA-256 54ad1084530d4f78…

MALICIOUS

PDF

38.7 KB Authoring application: OpenOffice.org
MD5: 61ee650cd731f5a2849e37b09a3bba2b SHA-1: b49c2bc8b7a5329256e1156fa6e7f01d84d625a4 SHA-256: 54ad1084530d4f783be9f26c7285cb203d8ea0dd5e0ca239c81e41d09ec71352
160 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF contains a large number of external links, many pointing to other PDFs, suggesting a link farm for SEO or traffic redirection. The heuristic 'SE_PASSWORD_ARCHIVE_LURE' indicates the document likely provides a password to access an encrypted archive or attachment, a common tactic to evade gateway scanning. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further confirms its malicious nature. The embedded URLs are likely part of this redirection or lure mechanism.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Password-protected archive handoff high SE_PASSWORD_ARCHIVE_LURE
    Document gives password instructions for an archive or attachment — often used to keep payloads encrypted until after gateway scanning
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gardenglassetc.com/uploads/1/3/0/3/130313144/4544a880c.pdf
    • http://tieagele.com/uploads/1/3/0/5/130589002/137741.pdf
    • http://rx4retirement.info/uploads/1/3/0/2/130270963/zidorole.pdf
    • http://discoveryresourcesllc.net/uploads/1/3/0/2/130291471/cd98ed9fdc.pdf
    • http://dostal.at/uploads/1/3/0/4/130478772/d5ca7f1b.pdf
    • http://retrocrawl.net/uploads/1/3/0/6/130639516/gunaxiguruko-gaxepitizo-luriroxodav.pdf
    • http://conectarealstaterelocations.com/uploads/1/3/0/7/130776719/bunopil.pdf
    • http://christianhartsough.com/uploads/1/3/0/8/130813577/wifajege.pdf
    • http://nickreese.net/uploads/1/3/0/6/130604938/nobigijuvaj_jaxilodolamovin_zibuxemiko_bazex.pdf
    • http://moyo-up.de/uploads/1/3/0/7/130775843/853750.pdf
    • http://sci-fi-club.com/uploads/1/3/0/2/130289259/titinokujebosenoruve.pdf
    • http://zemgear.com/uploads/1/3/0/6/130621456/wunowije_lenewikesagim_witojofud_zipopanuxigu.pdf
    • http://spyoptionstrade.com/uploads/1/3/0/5/130588639/61698.pdf
    • http://cassowaryday.org/uploads/1/3/0/3/130379222/8555045.pdf
    • http://richardsnyderbrownu.com/uploads/1/3/0/5/130545189/zorularuvewi.pdf
    • http://smokebrushfoundation.net/uploads/1/3/0/5/130539518/jaribovupogadim.pdf
    • http://cedricbrunelle.com/uploads/1/3/0/5/130588611/bigelitabazusaxo.pdf
    • http://234360060668842261.com/uploads/1/3/0/4/130483153/a3de59473515f6.pdf
    • http://emilyranney.com/uploads/1/3/0/6/130603887/1469420.pdf
    • http://ashesofren.com/uploads/1/3/0/3/130379123/9085986.pdf
    • http://daniellesmakeupcreations.com/uploads/1/3/0/6/130604708/0ebb8b8ce78.pdf
    • http://percy-macuinn.pleasingfood.com/uploads/1/3/0/3/130323412/130323412.html#download+adobe+flash+cs3+portable+bagas31
    • http://dostal.at/uploads/

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003648.bin
efaa9173aa27bc75ceb0b4f927077e49f57b223c4712430903c26d7c3a9347dc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3648 8124 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.