Malicious PDF — malware analysis report

Static analysis result for SHA-256 b147079a45d2316f…

MALICIOUS

PDF

28.4 KB Authoring application: OpenOffice Draw
MD5: 63daaba44d1182b7fa8987825e0329af SHA-1: 4bddddaea00b5d7701aed37c5bf134e1429907a8 SHA-256: b147079a45d2316fe65fa4fec784f0d74a4985ee325846c3a7c86617ef024bce
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected as malicious by ClamAV with the signature Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a large number of embedded external links, forming a link farm. These links likely serve as a lure to direct users to phishing or malware-hosting sites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tressesaunaturale.com/uploads/1/3/0/6/130604391/1947556.pdf
    • http://shannanstanciuforschoolboard.com/uploads/1/3/0/5/130539114/zewezi.pdf
    • http://nashvillerollingpins.com/uploads/1/3/0/6/130621071/madenaworulivebud.pdf
    • http://swingingcool.ch/uploads/1/3/0/5/130589429/5fe14c3ce.pdf
    • http://pensacoin.com/uploads/1/3/0/6/130620684/338725.pdf
    • http://www.mail.bostonhughes.com/uploads/1/3/0/6/130604788/ac57b7e4d.pdf
    • http://firebirdpoker.com/uploads/1/3/0/5/130589033/0765a9ddd4050.pdf
    • http://rambosiu.com/uploads/1/3/0/7/130775865/wakele-nibizamanuki-koviniso-mofesoteniwawe.pdf
    • http://ucporegon.org/uploads/1/3/0/3/130323506/132d1.pdf
    • http://meetthebeetles.info/uploads/1/3/0/5/130551206/cc3d3a.pdf
    • http://pencilpenservices.com/uploads/1/3/0/2/130288378/130288378.html#partition+guitare+facile+pirates+des+caraibes

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001952.bin
e8bc44f352058e6f813d631d8d444aa74720099d7c9f70ee89f31c325e15cc1a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1952 7572 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.