Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f77c75f9fadc6cf…

MALICIOUS

PDF

38.8 KB Authoring application: OpenOffice Draw
MD5: 4c0422cc71d10dfdfe3734ef549221c9 SHA-1: 411c080c455d4c8aa64c826fd28a7eb41100b729 SHA-256: 7f77c75f9fadc6cfa5c8492129907e82fef0ec304e5b35742e5867f06e7e6550
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further indicates a malicious intent, likely related to phishing or traffic redirection. The embedded document body text, though heavily corrupted, contains fragments related to 'brucelosis', suggesting a potential lure to disguise the malicious links. The primary attack pattern involves directing users to a network of external PDF files hosted on various domains.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://poorcomics.com/uploads/1/3/0/2/130287799/8139673.pdf
    • http://www.chestercanoehire.com/uploads/1/3/0/5/130550667/tiwen.pdf
    • http://golakeberryessa.com/uploads/1/3/0/7/130775825/sujapadulogonuzuxat.pdf
    • http://reliablemagic.org/uploads/1/3/0/6/130639377/xojawixutokosuxadu.pdf
    • http://www.vorbata.net/uploads/1/3/0/3/130379371/49974.pdf
    • http://karasholtz.net/uploads/1/3/0/4/130490451/ramamukiso.pdf
    • http://simplyyogavancouver.com/uploads/1/3/0/7/130775389/jidodibola.pdf
    • http://sqonecondos.com/uploads/1/3/0/6/130604104/f3f24.pdf
    • http://www.realtywithasmile.com/uploads/1/3/0/7/130775365/tosixozogiku.pdf
    • http://pureexistencedance.com/uploads/1/3/0/5/130547112/7680432.pdf
    • http://jagkcapitalpartners.com/uploads/1/3/0/8/130874023/mojobexituxovatogoge.pdf
    • http://people2005.com/uploads/1/3/0/7/130775107/tezuwago_jivajetes_sutezuj.pdf
    • http://undertoesyoga.com/uploads/1/3/0/6/130639933/e0d9ffa84631.pdf
    • http://alternativemedicine24.com/uploads/1/3/0/8/130813301/8815838.pdf
    • http://ebmccallanbuildingltd.com/uploads/1/3/1/0/131070972/131070972.html#tratamiento+para+brucelosis+en+bovinos

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003dea.bin
2cd26f457510dd7a176b25456ba505dfc6c037d9d5afcdf6419f885ac54c535e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3DEA 8468 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.