Malicious PDF — malware analysis report

Static analysis result for SHA-256 7f8f77f7361f564b…

MALICIOUS

PDF

39.6 KB Authoring application: OpenOffice.org
MD5: 89d0d793d1c4c6cffc96cca794c52705 SHA-1: 67371e4d08b50be3cb04256d111e6798c0be7c81 SHA-256: 7f8f77f7361f564bd77fda5023f4a5b45df93ba1a879f99a6083d37ebf3cb3d7
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents, a technique commonly used for SEO poisoning or to redirect users to malicious sites. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. The document body contains text related to 'Pokemon entei movie free online' and 'Download Torrents', suggesting a lure to attract users to click the malicious links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rendopoly.com/uploads/1/3/0/5/130588202/4880c18ae4df373.pdf
    • http://jenn4judge.com/uploads/1/3/0/5/130545557/migofodupuboba-jufonuz.pdf
    • http://pivotingdigital.com/uploads/1/3/0/2/130272327/93d857.pdf
    • http://aworldinneed.org/uploads/1/3/0/4/130491757/wosamaferogorosopig.pdf
    • http://razorodav.brgymahabangparang.com/uploads/2020/01/28/vozoforugux-rulibodafuj-rekavopiji.pdf
    • http://kzcoinex.com/uploads/2020/01/28/jenonalozibaf.pdf
    • http://metallicblackrecords.com/uploads/1/3/0/2/130270811/gofivavep-bomutusexofejo.pdf
    • http://544gorhamroad.com/uploads/1/3/0/4/130490444/koxek-baxipoxegep.pdf
    • http://genavuv.mbsmun.site/uploads/2020/01/28/fawepurogoj.pdf
    • http://jinufelin.alfavent.info/uploads/2020/01/29/6834688.pdf
    • http://onlinehomemyaccsupport706.com/uploads/1/3/0/4/130490399/130490399.html#pokemon+entei+movie+free+online

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012cc.bin
09e22a7a1fca33a2bcb62e64ab39f2e888ab2e5aa6e1a4649c41529f35057551		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12CC 8792 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.