Malicious PDF — malware analysis report

Static analysis result for SHA-256 a40334a06458ac34…

MALICIOUS

PDF

64.9 KB Authoring application: OpenOffice Draw
MD5: f422ab6147686776590dfbc3506fc15c SHA-1: 779ad01208ce429122c123a9b8e5ecc3a44e1376 SHA-256: a40334a06458ac34fdead1f485d99cc797b82f7a01b8b6caaa152d496567aae1
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to other PDF files, a technique often used for SEO poisoning or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the 'PDF_SEO_LINK_FARM' heuristic strongly indicate a phishing or malicious distribution campaign. The presence of a visual download button further supports the lure aspect of the attack.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nobuhotelriyadh-fullsite.devsite-1.com/uploads/1/3/0/6/130639630/e49c1037a21b.pdf
    • http://rfcbardstown.com/uploads/1/3/0/6/130604002/32ccb91ccf8e.pdf
    • http://babymyo.com/uploads/1/3/0/6/130639172/xevul_kagake.pdf
    • http://tecladomusicinstitute.com/uploads/1/3/0/4/130435561/4581992.pdf
    • https://mosurevefak.weebly.com/uploads/1/3/0/3/130313854/89b5d2c7d.pdf
    • http://mrsmeltabargersclass.com/uploads/1/3/0/4/130436121/6747381.pdf
    • http://fugo.cargo-floor.ru/uploads/2020/01/27/9805405.pdf
    • http://stokesed508webpage.com/uploads/1/3/0/5/130539309/130539309.html#baidu+browser+android+2.+3

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000011b9.bin
c1593611ea41db8511cae77687d75780f6111aefd9129b92330b90c7432b9192		 pdf-font-stream PDF embedded font (sfnt) at offset 0x11B9 9356 bytes
font_01_sfnt_off00005ff1.bin
ffcffba08ec7a91d6de2286f3915dd86aa019de37aaa2b85a36ec16e45d7be11		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5FF1 10756 bytes
font_02_sfnt_off00007795.bin
78b47b14ba5b73d70312cd59ddf517c844e7172847a7f12ebacfee1f3f3d5680		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7795 17256 bytes
font_03_sfnt_off00008ff1.bin
7e8fa069fa38c5fa88229cb6eb6452e9a174aa1cda72cc2f07f450a37fdef199		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8FF1 20160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.