Malicious PDF — malware analysis report

Static analysis result for SHA-256 7b9884eb70a5fb19…

MALICIOUS

PDF

42.4 KB Authoring application: OpenOffice Draw
MD5: 65e654051d52b40a2b23895b1235c664 SHA-1: ff6a74a7db31956bff3472cbf252997e4a85e196 SHA-256: 7b9884eb70a5fb19577b4e89a7ec798d20b8da6428492564acb3dfb2401aa7fa
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious nature of this file. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://giantcoffeepress.com/uploads/1/3/0/8/130814179/liwizajotepiguw.pdf
    • http://docksideengraving.com/uploads/1/3/0/3/130313410/a09c3f33.pdf
    • http://obtainablewellness.com/uploads/1/3/0/6/130604213/3200070.pdf
    • http://mobileteleprompter.net/uploads/1/3/0/5/130550997/pinanaju.pdf
    • http://trevordewitt.info/uploads/1/3/0/6/130604140/miliwuzerimane.pdf
    • http://www.enjoyyychristmas.com/uploads/1/3/0/3/130323421/loludesof_xifefumevume_kinanejoxuta.pdf
    • http://migrationcelebration.com/uploads/1/3/0/7/130776824/5974534.pdf
    • http://hostmaster.autoenrolmentadviser.xyz/uploads/1/3/0/7/130739090/c90f8cf4.pdf
    • http://greatsaltlakephotography.com/uploads/1/3/0/7/130739061/1860e2b.pdf
    • http://marcosleonsmith.com/uploads/1/3/0/5/130539021/3390977.pdf
    • http://colorsthatconvert.com/uploads/1/3/0/8/130814169/63340b76e6d.pdf
    • http://thepurposefulmama.com/uploads/1/3/0/6/130621587/dosonabo.pdf
    • http://www.valleyrage.com/uploads/1/3/0/5/130540477/1039610.pdf
    • http://alovida.com/uploads/1/3/0/2/130274199/189107.pdf
    • http://cannabishouse.biz/uploads/1/3/0/7/130776591/16fe7d1204.pdf
    • http://espaces.cz/uploads/1/3/0/6/130621072/tofubolisugedetuja.pdf
    • http://deas-guyz.com/uploads/1/3/0/7/130739552/sixox_josegezeg_xadik.pdf
    • http://dg3hu8.salon225.com/uploads/1/3/0/4/130483728/130483728.html#describe+how+the+earth%27s+history+can+be+interpreted+from+the+geologic+time+scale

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000048b0.bin
a92e8ae190fea83e22fd9ed35a86521a525e8f7db9afd43f706b9f9c49bda8d3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x48B0 8264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.