Malicious PDF — malware analysis report

Static analysis result for SHA-256 be0b45a1e60a26b6…

MALICIOUS

PDF

40.0 KB Authoring application: LibreOffice
MD5: 77e116c431e6ab28727e49c0033cfa6c SHA-1: a249e71735ade1f281eb2ee168b3f1f13ad3f3ad SHA-256: be0b45a1e60a26b644d69d90a55f55f702e42ca6eccfabca9b18d6edb69b13db
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm designed to manipulate search engine results or distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious distribution intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://insuranceclaiminfo.com/uploads/1/3/0/8/130814861/sarizabubiwomemetuji.pdf
    • http://indiefiancerecords.com/uploads/1/3/0/3/130379597/somevem.pdf
    • http://caracarpenter.com/uploads/1/3/0/5/130542852/3823206.pdf
    • http://clevelandprintworks.com/uploads/1/3/0/4/130483773/423730.pdf
    • http://www.rqgenesis.co/uploads/1/3/0/3/130313363/mupojezasegup.pdf
    • http://www.lectricwind.com/uploads/1/3/0/5/130551518/mejekeg_zunuxujowe_bofuriwarez.pdf
    • http://hostmaster.homesforhounds.org.uk/uploads/1/3/0/3/130313252/pesekita.pdf
    • http://ridgelineohio.com/uploads/1/3/0/6/130621706/1f80f69bc972a78.pdf
    • http://mesawindshieldrepair.com/uploads/1/3/0/3/130379824/lejorigagokado.pdf
    • http://eliganphotography.com/uploads/1/3/0/2/130270790/177510.pdf
    • http://pocketndt.net/uploads/1/3/0/6/130621282/tigimuwijesazi_motedunirujulo.pdf
    • http://artfullnessbymarlene.com/uploads/1/3/0/4/130491075/bfbf149310.pdf
    • http://initnowmix.com/uploads/1/3/0/7/130739318/ruvunogunenilopa.pdf
    • http://thejule.net/uploads/1/3/0/7/130776142/cb59eaa956bc3.pdf
    • http://boutiquevision.com/uploads/1/3/0/5/130543667/gawoxedigos.pdf
    • http://bmajorevents.net/uploads/1/3/0/5/130590357/130590357.html#dynamically+change+textbox+size+html
    • http://boutiquevision.com/uploads/1/3/0/5/13054366

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000027f2.bin
0c8b636322dcb4d69dd08a763b09c4b5ff2b7ea73056f43add13012560a79e6e		 pdf-font-stream PDF embedded font (sfnt) at offset 0x27F2 16076 bytes
font_01_sfnt_off00003f92.bin
6437a197a426fd3444b60fe4823d21f684863d58ff15e440d4a283640fd55ced		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3F92 8628 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.