Malicious PDF — malware analysis report

Static analysis result for SHA-256 577ea45f1f67d573…

MALICIOUS

PDF

39.2 KB Authoring application: OpenOffice.org
MD5: 81787644be1ee3698df17a3ae59babcb SHA-1: 38fe7531e2728498dfd501bb9e54490ecb926ea4 SHA-256: 577ea45f1f67d5731199e91343919c2b015863aa8cd605391d17cb8e3df25330
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDF files hosted on various external domains, a technique commonly used for SEO poisoning or phishing campaigns. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. The document body, though heavily obfuscated, contains references to business partnership agreements, suggesting a lure to entice users to click the malicious links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://umadevimohan.com/uploads/1/3/0/7/130775466/a8591c9c5.pdf
    • http://2daycashoffer.com/uploads/1/3/0/2/130270989/duwilixatevepatimof.pdf
    • http://www.bishopfamilybees.com/uploads/1/3/0/8/130874338/6463647.pdf
    • http://kevinmasse.com/uploads/1/3/0/2/130289453/kosegulerejipuvos.pdf
    • http://stewies.store/uploads/1/3/0/7/130738993/5d4c6595f.pdf
    • http://nikkiboklund.com/uploads/1/3/0/3/130313415/bewopejoxibe.pdf
    • http://elainearts.com/uploads/1/3/0/5/130588515/adfbe0b.pdf
    • http://www.padovecote.com/uploads/1/3/0/6/130620930/lidevifigeme.pdf
    • http://www.steambathparts.com/uploads/1/3/0/6/130603900/c7c6e4f.pdf
    • http://swoapy.com/uploads/1/3/0/6/130604414/1148360.pdf
    • http://www.mcardlemediallc.com/uploads/1/3/0/8/130874169/7527348.pdf
    • http://mysteretro.com/uploads/1/3/0/7/130740169/xumidevaxuse.pdf
    • http://www.freshepc.co.uk/uploads/1/3/0/5/130543488/nixamotiw_nepune_vulaki.pdf
    • http://empatheatre.net/uploads/1/3/0/5/130588654/wegowomazujafa.pdf
    • http://hitachimagicwand.us/uploads/1/3/0/6/130603728/6aa7b807d9.pdf
    • http://nunavikyouthhouseassociation.com/uploads/1/3/0/5/130539783/8211319.pdf
    • http://newzealandlgbtiaward.com/uploads/1/3/0/2/130272603/bc602.pdf
    • http://operationpurplepaws.org/uploads/1/3/0/9/130970022/solezijurasupe-rurabexemexe-dobumoloxelip.pdf
    • http://autoseeding.net/uploads/1/3/0/8/130813956/lexefelowe.pdf
    • http://www.compassiontransport.com/uploads/1/3/0/3/130379612/riputadozo-jukenova.pdf
    • http://alphabetty.org/uploads/1/3/0/5/130550698/zoxen-vimidakixox-tawubabaduvatox.pdf
    • http://extravirgincoffee.com/uploads/1/3/0/7/130740556/130740556.html#business+partnership+agreement+format+pdf
    • http://nunavikyouthhou

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003968.bin
920806959a0d4dfcd01ef471b0a0638a92cc0657fbaa201a05990d7c6e5f45d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3968 7736 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.