Malicious PDF — malware analysis report

Static analysis result for SHA-256 9bf7a6104df38e51…

MALICIOUS

PDF

133.4 KB Authoring application: OpenOffice.org
MD5: 7c66b24dd8166f7338683ac8f365f9c8 SHA-1: f51aef411d52512e08f7c84560e91cecf79046c5 SHA-256: 9bf7a6104df38e51d8e40cafb4707ab769c9a6b7f9d925dbd1b9fedb5ddf13cd
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. No scripts were extracted from this sample, limiting the ability to determine specific execution chains.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://warsofgod.com/uploads/1/3/0/8/130874370/fanifivadajujam.pdf
    • http://mixrobot.net/uploads/1/3/0/6/130605238/5942753.pdf
    • http://thekaratemartstore.com/uploads/1/3/0/6/130639027/ebb10cc.pdf
    • http://remcofitness.com/uploads/1/3/0/6/130604962/tefonutemefiwilo.pdf
    • http://www.suncresttech.com/uploads/1/3/0/6/130620521/2571788.pdf
    • http://absoluteventoparty.com/uploads/1/3/0/7/130740118/mikerazi.pdf
    • http://mypromobook.com/uploads/1/3/0/5/130550972/1183273.pdf
    • http://altasanacion.net/uploads/1/3/0/7/130739631/5161889.pdf
    • http://nolaproauto.com/uploads/1/3/0/6/130603851/petazaxoto_xemokojexez.pdf
    • http://ilonggo.net/uploads/1/3/0/2/130289543/zufoja.pdf
    • http://dorzasdrivingschool.com/uploads/1/3/0/2/130272937/f3b7e9530.pdf
    • http://christinecarson.net/uploads/1/3/0/6/130620501/xanuv.pdf
    • http://74-123-78-37.mgwnet.com/uploads/1/3/0/5/130590666/130590666.html#american+english+file+1a+student+book+2nd+edition+pdf

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000045fa.bin
4d00e61e659320bf4de1399a65b15ff72b2cd5cf980d1d4279fe84f4cf9dfaa5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x45FA 2648 bytes
font_01_sfnt_off00005300.bin
d298f09551dcfc4df622cbe0c828fcd663541dccf8031efd25d10f0e1f3e8cb1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5300 11212 bytes
font_02_sfnt_off00012a9c.bin
1e8fa3801dc361043dcff0fdeaa33696134c1188560bd092a194b9ce3c461a72		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12A9C 16232 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.