Malicious PDF — malware analysis report

Static analysis result for SHA-256 a82b5e6eab1a1843…

MALICIOUS

PDF

39.2 KB Authoring application: LibreOffice Draw
MD5: 6dd214bd4fb8ad541867804da726b9b2 SHA-1: 4870f35156e894631978ad12ec6cd6276d4c3d21 SHA-256: a82b5e6eab1a18431820463f13adfa3e37bc2335e7c1bdca528fb390b4a48824
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or redirection campaign. The ClamAV detection further supports its malicious nature. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://voraginedeescritores.com/uploads/1/3/0/7/130738735/vewuzoba.pdf
    • http://www.einslearningcenter.com/uploads/1/3/0/8/130815009/2582632.pdf
    • http://makeitwordpress.com/uploads/1/3/0/6/130604049/kumuneg.pdf
    • http://lotusmediaprint.com/uploads/1/3/0/5/130551140/6863692.pdf
    • http://pelicanstl.com/uploads/1/3/0/5/130539657/7377466.pdf
    • http://soundnotion.tv/uploads/1/3/0/7/130739935/vipevolatizigevovini.pdf
    • http://modernwomantour.com/uploads/1/3/0/5/130540604/pofufisilatum.pdf
    • http://baileyjohall.com/uploads/1/3/0/7/130776222/00cc7809481.pdf
    • http://www.hellotherepr.com/uploads/1/3/0/7/130738805/1764664.pdf
    • http://cpoaklandpresentation.com/uploads/1/3/0/5/130590413/35aa61ee8c5a.pdf
    • http://acmehempcompany.com/uploads/1/3/0/7/130739764/botezatu_wazobew_joxafuwumadi_tifajefamivirat.pdf
    • http://anatoly-nikolsky.com/uploads/1/3/0/5/130551554/299971.pdf
    • http://nourishsinglemoms.org/uploads/1/3/0/8/130813648/zobutironufes_juwokozugomul.pdf
    • http://directcarenepal.org/uploads/1/3/0/2/130273987/7270e.pdf
    • http://mrsjessinaanderson.com/uploads/1/3/0/8/130813988/bovobiwonivokap-golosoridelu-jisofolovuti.pdf
    • http://smokinjoes.net/uploads/1/3/0/9/130969266/demukip-tojibopokuxu.pdf
    • http://londyn.letenky-sky.sk/uploads/1/3/0/7/130775503/dojesujaw-welifujabug-robivisazuk.pdf
    • http://www.unnamedclothing.com/uploads/1/3/0/6/130604583/ec3a7c0f9bbf6.pdf
    • http://www.mbkenyatrip17.com/uploads/1/3/0/7/130776561/16845.pdf
    • http://islamic-global.net/uploads/1/3/0/3/130313155/sugotukuzotij-fijibetiratuno-pijiw-zotumexisodep.pdf
    • http://kennedyatlibrarysquare.com/uploads/1/3/0/5/130544468/funudixudifefipubuk.pdf
    • http://moirarogers.net/uploads/1/3/0/4/130436054/0d7d729a79f2.pdf
    • http://mr-riks.com/uploads/1/3/0/5/130588827/juxikenutiguv_xomugiwajixu_vulesum_vulatomaka.pdf
    • http://onlinesmdc.com/uploads/1/3/0/5/130543028/130543028.html#aadhar+card+date+of+birth+change+gazetted+officer+format
    • http://directcarenepal.org/uploads/1

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000028c1.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x28C1 2652 bytes
font_01_sfnt_off00003491.bin
4b93d17b2fa5cc33452931b5738f4c3642715a757437d7e57d0eec9d3ffad324		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3491 8396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.