Malicious PDF — malware analysis report

Static analysis result for SHA-256 ba3b1c408d92c248…

MALICIOUS

PDF

39.1 KB Authoring application: OpenOffice Draw
MD5: 51152602ec24837f6a29e35aea2b199f SHA-1: cc1a021f8499f4c737fe5524e3d8ee9a3e639820 SHA-256: ba3b1c408d92c248884d98a3c5d3a48a72449ae96cad65e5045cbc543600dca8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to other PDF files, a technique commonly used in SEO poisoning and phishing campaigns to drive traffic to malicious sites. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing classification. The document body, though partially corrupted, mentions 'Indian accounting standards pdf notes', suggesting a lure to attract users seeking educational materials.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://laurynstanlake.com/uploads/1/3/0/4/130488362/2d90e.pdf
    • http://beaniesshoerepair.com/uploads/1/3/0/2/130271002/5462572.pdf
    • http://zumbatinleypark.com/uploads/1/3/0/2/130271167/bbcc358f1d4e.pdf
    • http://accomplishdreams.net/uploads/1/3/0/2/130288567/3658281.pdf
    • http://eco2magnesia.com/uploads/1/3/0/2/130272384/cadc3a7e5.pdf
    • http://lov.jila12.com/uploads/2020/01/28/febib-pifewa-xofago.pdf
    • http://anniebeg.com/uploads/1/3/0/8/130874130/9513182.pdf
    • http://drpatty.net/uploads/1/3/0/6/130639395/130639395.html#indian+accounting+standards+pdf+notes

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010e0.bin
92fa8046ae3a04d2cf5dcb3698f0dc6f87d827f713282f0281ed84f9931225ba		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10E0 8076 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.