Malicious PDF — malware analysis report

Static analysis result for SHA-256 be92829d7d4c87db…

MALICIOUS

PDF

53.9 KB Authoring application: LibreOffice
MD5: 62c7ffc3eb936903d127e365e06d6d4a SHA-1: a63388459fa1514f8859803f3a1e461fb7f3e2f1 SHA-256: be92829d7d4c87db449e35731e924fe45f90fbc1ff7fe9ca7c23fe0618116695
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files, a technique commonly used for SEO poisoning or phishing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. The document body, though heavily corrupted, contains fragments of URLs that align with the embedded link farm.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wavetechinc.org/uploads/1/3/0/6/130639408/gemowib-xeviririmoni.pdf
    • http://englishinsights.com/uploads/1/3/0/8/130814295/wikufijo-wapizaka-fidigikiwewox.pdf
    • http://noahsteinman.com/uploads/1/3/0/5/130541137/81777e.pdf
    • http://delbertsonrealty.com/uploads/1/3/0/6/130622077/834be7.pdf
    • http://fuxionadosargentina.com/uploads/1/3/0/6/130639762/wupaluzekasu-gusofenuzesup-mibira.pdf
    • http://lwrhigh.com/uploads/1/3/0/6/130604090/gokifesawu-tajifozefibag-parosurar.pdf
    • http://ywlfoundation.com/uploads/1/3/0/3/130323235/6786050.pdf
    • http://bisconsulting.it/uploads/1/3/0/4/130478438/2918399.pdf
    • http://olympic-custom-construction.com/uploads/1/3/0/5/130551349/fozenuresorem.pdf
    • http://plex.run/uploads/1/3/0/6/130621201/6287344.pdf
    • http://zaixianbaijiale.f18.ebkf.org/uploads/1/3/0/8/130814293/4c8c2c6be5230.pdf
    • http://mynorahaze.com/uploads/1/3/0/5/130540699/rawibum.pdf
    • http://coldchaos.com/uploads/1/3/0/6/130620384/zosekevazikeda.pdf
    • http://mitchgallagherband.com/uploads/1/3/0/6/130621890/nukaxejo-nitevo.pdf
    • http://brownallyear.kiwi/uploads/1/3/0/5/130539645/2567956.pdf
    • http://www.esplinorganicsolutions.com/uploads/1/3/0/5/130550743/6d4f4eee7725b01.pdf
    • http://brookeholden.com/uploads/1/3/0/3/130323208/9127639.pdf
    • http://gyrtn.bpmtc.com/uploads/1/3/0/7/130739376/130739376.html#agroforestry+system+in+the+philippines

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000010d4.bin
2b728203df75179237bef3653d0e8094e209bd88f2cd2af59e37ddeaf34bb47d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10D4 9668 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.