Malicious PDF — malware analysis report

Static analysis result for SHA-256 a54dd423146896f8…

MALICIOUS

PDF

124.6 KB Authoring application: OpenOffice.org
MD5: b8ef85915a40449fc12c5efc0c982396 SHA-1: 63bddd08bf58435632850f517beef0c95fd6608c SHA-256: a54dd423146896f8774a61fce1e463cb332d168007776af004e905874fdfbd5a
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to other PDF files. The document body also contains a call-to-action phrase, suggesting a lure to download these linked files. ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or malicious download intent.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://starlightimagestudio.com/uploads/1/3/0/2/130291827/zelekurir.pdf
    • http://kunzeartgallery.com/uploads/1/3/0/2/130272856/1397255.pdf
    • http://nsolc.com/uploads/1/3/0/5/130590392/duzowosuxefuk.pdf
    • http://episcopalchurchmediator.com/uploads/1/3/0/5/130550743/ed2cece462e27.pdf
    • http://mrsneuville.com/uploads/1/3/0/6/130620973/2436894.pdf
    • http://mydjdave.com/uploads/1/3/0/6/130621645/8523870.pdf
    • http://ekki.co/uploads/1/3/0/6/130621052/1968de236014.pdf
    • http://royalglossbrat.com/uploads/1/3/0/7/130740264/zanosonilov_lifinasidinalew.pdf
    • http://koahspearfishing.com/uploads/1/3/0/4/130435583/9439506.pdf
    • http://arcadiagardensllclandscapinganddesign.com/uploads/1/3/0/5/130544147/130544147.html#alter+ego+plus+a2+guide+pedagogique+download

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001453.bin
00d6d7294e269245f76edf232f88ec4941478bbe31201f00441ea147c578f44d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1453 11572 bytes
font_01_sfnt_off000074ce.bin
453fb7942731013dcab42868264a9be19bd099a1032bb61405edb9d98f7c3022		 pdf-font-stream PDF embedded font (sfnt) at offset 0x74CE 2840 bytes
font_02_sfnt_off00007e57.bin
ee2ee7d9fd984eaf0dacc3bd179e21b7962687f6d6ad7c9b686731f8c417da81		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7E57 16220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.