Malicious PDF — malware analysis report

Static analysis result for SHA-256 b1fe7b7c095b0e71…

MALICIOUS

PDF

39.3 KB Authoring application: OpenOffice Draw
MD5: 6193f59ed26842d1a17dd8491650fbf3 SHA-1: a8988d8dc1896b679553d9ce0be819791dd4161d SHA-256: b1fe7b7c095b0e719cf1d46ddead236485dd29df7bba78f4e9b967f981d7ea30
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF documents hosted on various domains. This behavior is indicative of a link farm or a phishing campaign designed to redirect users to malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing classification.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://annesketch.com/uploads/1/3/0/3/130323511/7336958.pdf
    • http://www.crystaltrimming.com/uploads/1/3/0/4/130436095/xukugosadeguti.pdf
    • http://activhealthadmin.com/uploads/1/3/0/6/130620587/6551428.pdf
    • http://mail.fiscaal-zzp-advies.nl/uploads/1/3/0/8/130814562/bipalijevumes_voguve_musebazo.pdf
    • http://lajollalouvre.com/uploads/1/3/0/5/130588663/674e8ae87e5.pdf
    • http://renderbarn.com/uploads/1/3/0/6/130604049/8220505.pdf
    • http://mydrivecash.com/uploads/1/3/0/5/130588988/sesep_joxup_ronizun.pdf
    • http://compuspa.ca/uploads/1/3/0/2/130274281/dutow_xavodegulena_fewabijurivune.pdf
    • http://4gwireless.com/uploads/1/3/0/5/130588210/2606318.pdf
    • http://weavegotknotsandmore.com/uploads/1/3/0/9/130969421/2531041.pdf
    • http://flow-wandering.com/uploads/1/3/0/2/130288875/9c1fc32bfd7d.pdf
    • http://militarybibleassociation.com/uploads/1/3/0/5/130546923/1801834.pdf
    • http://norascully.com/uploads/1/3/0/8/130815014/17bf9ff089f0.pdf
    • http://napawinemagazine.com/uploads/1/3/0/5/130551576/vazodudefoxepetirig.pdf
    • http://deafphonics.com/uploads/1/3/0/3/130379113/6374754.pdf
    • http://equilibrium21.online/uploads/1/3/0/7/130738861/jijenazuvo-zewiponumubozow-laniwofol-wopenufazaja.pdf
    • http://adsl-63-204-18-10.benefitplans.org/uploads/1/3/0/7/130738641/130738641.html#harris+teeter+assistant+customer+service+manager+job+description
    • http://www.crystaltrimming.com/uploads/1/3/0/4/130436095/xukugos

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003d2f.bin
50ff44bec90ea87d611d4fb005e96a31d78f55db728954528dcfac262c73d2f5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3D2F 8180 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.