Malicious PDF — malware analysis report

Static analysis result for SHA-256 8174d681fdaa2f2f…

MALICIOUS

PDF

37.2 KB Authoring application: OpenOffice.org
MD5: 64e64d7dcbb5cd161ada3906608e28d6 SHA-1: d8f0d429bcd830e75a0bbf9621a5fec7d9e084c2 SHA-256: 8174d681fdaa2f2f0ee854b636b571afc12597a58882efe09e33b6e8a0b87361
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious classification. The embedded URLs are likely used to distribute phishing content or for SEO manipulation to drive traffic to malicious sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bottomlesshole.com/uploads/1/3/0/4/130476786/fopit-melajekupa-jafojeri-vupimelikuvog.pdf
    • http://whiteisleproperties.com/uploads/1/3/0/5/130551001/geduxarexutawov-tuxekidijijer.pdf
    • http://thegullywhompers.com/uploads/1/3/0/3/130323301/livumoninuruv.pdf
    • http://aceitesdelatierra.com/uploads/1/3/0/5/130550667/c7520c4066ef.pdf
    • http://beyondcleanmaids.ca/uploads/1/3/0/5/130551249/mejumirarepapidaketa.pdf
    • http://dreamfluffers.com/uploads/1/3/0/4/130476348/b92337b6025fe1a.pdf
    • http://sbwd.company/uploads/1/3/0/7/130776519/xavotev.pdf
    • http://www.creativefercrosstechnology.com/uploads/1/3/0/8/130874613/fufumabetebigik-lamumerizo.pdf
    • http://uintahonlinek8.com/uploads/1/3/0/6/130603676/2747943.pdf
    • http://jessethorn.com/uploads/1/3/0/8/130873958/mikimikul_siturefaluza.pdf
    • http://babyboostco.com/uploads/1/3/0/5/130543285/1198015.pdf
    • http://champastreet.com/uploads/1/3/0/3/130379575/7891050.pdf
    • http://usamedicaltravel.com/uploads/1/3/0/2/130272081/bamug_biradiv_buromegomoxobux_melajulu.pdf
    • http://www.lionsclub5k.com/uploads/1/3/0/6/130620334/mibem.pdf
    • http://clearhrsolutionsd.com/uploads/1/3/0/5/130545681/19ea16f5.pdf
    • http://homespark.net/uploads/1/3/0/6/130621592/vifenifitetazu.pdf
    • http://annmajercik.com/uploads/1/3/0/5/130588588/74a73.pdf
    • http://www.hannahlewisphotography.com/uploads/1/3/0/5/130588806/6a841955.pdf
    • http://naturalisllc.net/uploads/1/3/0/6/130620480/vurowobod.pdf
    • http://austinlair.com/uploads/1/3/0/6/130605104/e87449e1d5d.pdf
    • http://cvkgroupnew1.devsite-1.com/uploads/1/3/0/5/130551249/130551249.html#what+is+cultural+ecology+in+human+geography

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003285.bin
317728c6c7df2d83fdc649b5a0b8f99070c992f1f1f60097f8e3480f4d661f36		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3285 7668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.