Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab023a2df7169431…

MALICIOUS

PDF

48.7 KB Authoring application: OpenOffice Draw
MD5: 890f9b2c689ae2e2a3846ce62f0c67b0 SHA-1: 8ca616bba03fdf335f5bc616b4636e7790a3d467 SHA-256: ab023a2df7169431bd639cf223470a784c8959c041acb2f55d92a4c194397c7d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic and ClamAV detection. The document body itself contains garbled text and a few URLs, reinforcing the malicious intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bigscarythings.com/uploads/1/3/0/3/130313069/3122542.pdf
    • http://theroyalapartment.com/uploads/1/3/0/7/130739098/gipupunurubitukex.pdf
    • http://amckbc.com/uploads/1/3/0/5/130589202/sovux-rugedexugonip-nifefagu-netinozojogapif.pdf
    • http://semuwas.volkanarslan.net/uploads/2020/01/28/mugemudarezekowug.pdf
    • http://daytonconcretecontractors.com/uploads/1/3/0/6/130620890/bepivokomojapam.pdf
    • http://nightshadejewelry.ca/uploads/1/3/0/5/130540501/5596005.pdf
    • http://staterealty.ru/uploads/2020/01/28/vetugaf.pdf
    • http://specialhairstyle.com/uploads/1/3/0/4/130488832/gozikidobikegir_mudigo_wupiketetejizun.pdf
    • http://alextindall.net/uploads/1/3/0/6/130603932/9305722.pdf
    • http://valkrystore.org/uploads/1/3/0/2/130287394/jibepikuxa-kiletu-xozufigujemokad.pdf
    • http://dollarstore-plus.com/uploads/1/3/0/5/130539092/5288104.pdf
    • http://beabadocompositor.com/uploads/2020/01/28/posaruxerufatuzo.pdf
    • http://nashobavalleyextractco.com/uploads/1/3/0/7/130739596/130739596.html#application+letter+for+job+format+word

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00000f60.bin
fa002292090826c3049088c1b45631cb006183c63345dcca8e8c260830f30465		 pdf-font-stream PDF embedded font (sfnt) at offset 0xF60 7976 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.