Malicious PDF — malware analysis report

Static analysis result for SHA-256 a8348d6e97c8803b…

MALICIOUS

PDF

40.4 KB Authoring application: OpenOffice.org
MD5: 632fdf1c80e77277301b2830a3471fad SHA-1: 616ec9e92e3063cfe0f31cff1b1358e2aae24c3e SHA-256: a8348d6e97c8803bbef90b10b415c93f0e1aaf8d0e41033542261f772a6021c6
140 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF is detected as a phishing lure, containing a screenshot designed to trick users into clicking an embedded link. This link leads to a farm of 31 other PDF files, suggesting a campaign to distribute content or redirect users through a network of compromised domains. The ClamAV detection further supports the malicious classification.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Image-only document with action trigger (screenshot lure) medium PDF_IMAGE_LURE
    PDF has 1 image(s), only 0 text block(s), carries a click-outward action, and is only 40 KB — typical shape of a phishing lure where a full-page screenshot hides a clickable button that launches or submits to an attacker URL.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.sys.histomedical.com/uploads/1/3/0/7/130738874/zeropifusenegefenu.pdf
    • http://smartlookpalakollu.com/uploads/1/3/0/8/130874668/xefurixokemabojanan.pdf
    • http://tamplar-brasov.com/uploads/1/3/0/5/130551417/wavuja_zuvexet_nobuwi_simiwopuvuwak.pdf
    • http://ameliashomes.com/uploads/1/3/0/6/130639296/0ab2da6.pdf
    • http://soniamariemetals.com/uploads/1/3/0/7/130739162/novasuluxuxeja.pdf
    • http://ecosystemproduction.org/uploads/1/3/0/6/130604045/folebotolite-nubejixupamoga-ferofita-migixu.pdf
    • http://mty.news/uploads/1/3/0/2/130289426/5372954.pdf
    • http://virtualassistant-usa.com/uploads/1/3/0/5/130545745/ef6201.pdf
    • http://smythgetssexy.com/uploads/1/3/0/7/130776489/1064015.pdf
    • http://skincarebymarina.net/uploads/1/3/0/7/130739970/3670787.pdf
    • http://reclaimtheday5k.com/uploads/1/3/0/9/130969452/jasewenabud.pdf
    • http://afterthesunsetsgames.com/uploads/1/3/1/0/131070888/8297879.pdf
    • http://crescitegranum.com/uploads/1/3/0/4/130488847/pivoxebubole-kisobom.pdf
    • http://charlottejackman.com/uploads/1/3/0/3/130379625/mevojosodewibo.pdf
    • http://riversnetwork.net/uploads/1/3/0/8/130874629/mubif_joxutetolerili_sadob.pdf
    • http://financialbodyofknowledge.com/uploads/1/3/0/3/130379274/1f0a8532.pdf
    • http://www.bravemotorsport.com/uploads/1/3/0/3/130323707/lomawosebolofebovug.pdf
    • http://betteraustintoday.com/uploads/1/3/0/6/130621075/ratedabolegesa.pdf
    • http://mysterclothingbrand.com/uploads/1/3/0/6/130621713/vadipuju-bemarazelelipu-larubazava.pdf
    • http://hillrecruiting.marketingfactorygroup.com/uploads/1/3/0/4/130483299/nakufez-puwozujika-wosopo.pdf
    • http://alexisbriggs.com/uploads/1/3/0/6/130639138/vejenasaku.pdf
    • http://impresariofilm.com/uploads/1/3/0/5/130588542/vubuvifugopew.pdf
    • http://calciopreviews.com/uploads/1/3/0/7/130775554/vujaban-jejalopenag-tekiroxi.pdf
    • http://xiaoyouqipaixiazai.br3h.com/uploads/1/3/0/7/130776298/130776298.html#carrier+air+conditioning+remote+control+manual
    • http://www.sys.histomedical.com/uploads/1/3/0/7/130738

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000043f8.bin
a89e2553e2e866a2dd0cbcad0baeb6b04c1a35468143dbcf355acfcd9cde34db		 pdf-font-stream PDF embedded font (sfnt) at offset 0x43F8 4948 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.