Malicious PDF — malware analysis report

Static analysis result for SHA-256 9018d6be704f9fc7…

MALICIOUS

PDF

48.3 KB Authoring application: LibreOffice Draw
MD5: 444dbaf00c2989f08811104742c072db SHA-1: 69826f881e27ab7f77de7d76091eae81d0de9f25 SHA-256: 9018d6be704f9fc706f97b2a6cee4e43cb00178ea59dcc25d731794716a94ed0
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1204.002 Malicious File: Malicious Link

The PDF file contains a large number of embedded URLs, identified as a 'PDF_SEO_LINK_FARM' heuristic. These URLs likely lead to further malicious content, such as phishing pages or malware downloads. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and malicious intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dottis.ch/uploads/1/3/0/6/130620660/acee961e9.pdf
    • http://arceasternpanhanlde.org/uploads/1/3/0/6/130639678/6557c.pdf
    • http://juliaplaysaccordion.com/uploads/1/3/0/2/130289448/2843789.pdf
    • http://sirinavideo.com/uploads/1/3/0/6/130604354/1484638.pdf
    • http://deviatedsanctum.com/uploads/1/3/0/5/130550944/7f285.pdf
    • http://webdisk.whitehartinwitham.co.uk/uploads/1/3/0/5/130551534/ruwodem.pdf
    • http://chloeraywarmoth.com/uploads/1/3/0/8/130813510/6848936.pdf
    • http://www.mycupidclothing.com/uploads/1/3/0/8/130874010/4205f2cc0.pdf
    • http://jofcompany.com/uploads/1/3/0/8/130874389/92bae4.pdf
    • http://mysterytomb.com/uploads/1/3/0/5/130588640/gotagawuxisori.pdf
    • http://therhinestoneanchor.com/uploads/1/3/0/6/130639424/3dc41917c49425.pdf
    • http://dalestanford.com/uploads/1/3/0/7/130738721/abdb38662.pdf
    • http://bubblebag-australia.com/uploads/1/3/0/7/130739949/lumipuwamotafek_sufofekuxo_fotavok.pdf
    • http://bucketsofbrassandcopper.com/uploads/1/3/0/7/130739713/gisozidanit-kazepawenerok-kaboralaf-wawovajawap.pdf
    • http://stedwardschoolchristmastreefundraiser.com/uploads/1/3/0/8/130814083/tedekaxudow_pibubosadusija_rovetidodije.pdf
    • http://betterwiththebible.com/uploads/1/3/0/5/130550985/vasivinaroxe.pdf
    • http://adelaidehulahoopers.com.au/uploads/1/3/0/7/130739021/kozunusosulidaluzel.pdf
    • http://cinderellascleaningcompany.com/uploads/1/3/0/3/130323520/130323520.html#pfsense+firewall+

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00005e7c.bin
547f204a8b65d8a7352ccf7df19b5f21730de726dfd3480632b663bc2a5241b4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5E7C 8788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.