Malicious PDF — malware analysis report

Static analysis result for SHA-256 776699686a1ff989…

MALICIOUS

PDF

50.1 KB Authoring application: OpenOffice.org
MD5: 619caaf7ce8c4b6794e858dd143ad706 SHA-1: 4ec2b9d0ed6848caca014f56c06eda05b7ac1f22 SHA-256: 776699686a1ff989032af5afa63e2434b96f6339e1249d552f4801bcaa04d9ae
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique commonly used to redirect users to malicious websites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. The embedded URLs point to various domains, all appearing to host PDF files, suggesting a link farm designed to distribute malicious content or lead to phishing pages.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://damaebanisteria.com/uploads/1/3/0/6/130605263/3467709.pdf
    • http://www.colorfulmodern.com/uploads/1/3/0/7/130738591/zawipa.pdf
    • http://botoxduluth.com/uploads/1/3/0/7/130775297/9500864.pdf
    • http://cpanel.cascadebga.org/uploads/1/3/0/6/130639357/razokapumalogakal.pdf
    • http://www.luther2017.org/uploads/1/3/0/4/130488834/remolop.pdf
    • http://danaroberts.com/uploads/1/3/0/5/130588740/mumijejaf-baragevugegag-bofibagenezuvo.pdf
    • http://janeflegal.com/uploads/1/3/0/5/130539652/nibud.pdf
    • http://abundantlifecog.net/uploads/1/3/0/7/130775361/nozidi_xudivorufovugof.pdf
    • http://silverarcherdesigns.com/uploads/1/3/0/3/130323601/nefagokun.pdf
    • http://cemento-stampato.org/uploads/1/3/0/6/130621698/xorogugarig-kerazok.pdf
    • http://albara4u.com/uploads/1/3/0/5/130550983/xupuzimipoges.pdf
    • http://dns1.rubenslamel.com/uploads/1/3/0/8/130813991/duveto_rewazobofu_mobofitumur_marepubanuga.pdf
    • http://ddiamondco.com/uploads/1/3/0/7/130739379/jugunewazedu.pdf
    • http://hostmaster.zingezong.com/uploads/1/3/0/8/130874655/zopakozexo.pdf
    • http://bohojane.com/uploads/1/3/0/7/130775164/71ce35a.pdf
    • http://stop-n-smelltheflowers.com/uploads/1/3/0/6/130620763/makolujudedejabijuna.pdf
    • http://myescondidosoccer.com/uploads/1/3/0/4/130475955/dipopiga.pdf
    • http://webdisk.xebex.eu/uploads/1/3/0/6/130605019/8070092.pdf
    • http://islandscast.com/uploads/1/3/0/8/130874143/5308948.pdf
    • http://www.panduct.com/uploads/1/3/0/2/130271113/fibibiwoxifinix.pdf
    • http://extentrics.com/uploads/1/3/0/4/130483288/4580390.pdf
    • http://harrisonashtonphoto.com/uploads/1/3/0/5/130540085/f41e4fb19224c.pdf
    • http://taiyangchengyulewang888ya.br3h.com/uploads/1/3/0/6/130603842/130603842.html#online+unicode+hindi+typing+test+remington+keyboard

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003255.bin
d24dbdf357729008218e53e6619941fe87146988c8cb5017a7c1158471ec3b8b
pdf-font-stream PDF embedded font (sfnt) at offset 0x3255 8664 bytes
font_01_sfnt_off00004c8d.bin
dcb05807abfffaebab1386e3798b0cab0a98394977d664f1624ac0fdaa3ad1f8
pdf-font-stream PDF embedded font (sfnt) at offset 0x4C8D 8556 bytes
font_02_sfnt_off00006944.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63
pdf-font-stream PDF embedded font (sfnt) at offset 0x6944 16036 bytes