Malicious PDF — malware analysis report

Static analysis result for SHA-256 becff86c36137b7a…

MALICIOUS

PDF

42.7 KB Authoring application: OpenOffice.org
MD5: 5cde5d02eae9d19ac3650a5a3e714f0f SHA-1: ec10c151aca8d4a960a35f003bc56296a5edf339 SHA-256: becff86c36137b7a993dc00321a3d733b5c91b0345357eeb85af278c3bc01875
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. The document body's content appears to be corrupted or truncated, providing no direct clues to the specific lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://topdoc.net.au/uploads/1/3/0/7/130739758/buzivima.pdf
    • http://miwoori.net/uploads/1/3/0/5/130540725/323797.pdf
    • http://urenough.com.au/uploads/1/3/0/5/130588333/xomafuvalatigonanod.pdf
    • http://silver-linings-speechtherapy.com/uploads/1/3/0/6/130605164/pudunakatixuteg_lekozawivesad.pdf
    • http://idcotter.com/uploads/1/3/0/4/130476378/ec708ef2a473.pdf
    • http://christyrobbcareerandlifestyle.com/uploads/1/3/0/8/130873779/bixeselozuxosiz-judawinot.pdf
    • http://americanlighting.org/uploads/1/3/0/6/130620796/ad3b571b.pdf
    • http://draasman.com/uploads/1/3/0/5/130538866/pasokebekumo.pdf
    • http://www.upallnite.org/uploads/1/3/0/8/130873894/2319221.pdf
    • http://need4relief.com/uploads/1/3/0/7/130740262/4285907.pdf
    • http://teamrise.global/uploads/1/3/0/2/130271017/paxozanibozovuz-sifegax-fibuku-xifevebapoze.pdf
    • http://jmnofixedaddress.com/uploads/1/3/0/2/130288629/zoxakopadajo.pdf
    • http://speed-gemmes.com/uploads/1/3/0/7/130776730/momebum.pdf
    • http://rickyzheng.net/uploads/1/3/0/2/130292073/beresopezefanumo.pdf
    • http://traveleatexplore.com/uploads/1/3/0/2/130271072/6671007.pdf
    • http://www.bfandg.net/uploads/1/3/0/4/130489523/baxakojo.pdf
    • http://dacusconsultingco.com/uploads/1/3/0/8/130873828/mofetezexepoj.pdf
    • http://eatonhousewhiskey.com/uploads/1/3/0/6/130639774/vewanidu.pdf
    • http://coffmannursing.com/uploads/1/3/0/6/130621191/xawalef-duzapojunera.pdf
    • http://marijuanacultivationconsultants.com/uploads/1/3/0/5/130588230/zediturejo-fazebu-pokofanawunes-difera.pdf
    • http://thededicatedgenealogist.com/uploads/1/3/0/8/130813539/mororaxalewopunamaf.pdf
    • http://gmsdezigns.org/uploads/1/3/0/6/130622083/wijuwurez-jipigawujuzesa.pdf
    • http://jacquipriestleyartist.com/uploads/1/3/0/6/130620176/vixun-rebokoxo-berem-mazapup.pdf
    • http://houseof7brothers.com/uploads/1/3/0/9/130969820/7416390.pdf
    • http://bet365zhongwen.br3h.com/uploads/1/3/0/5/130542727/130542727.html#clerks+private+sector+modern+award+2010
    • http://www.upallnite.org/uploads/1/3/0/8/130

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000041fd.bin
ee742cb584884cdda15cda5b5214a31968b552ed053d4fa1a8c7317c07776faa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x41FD 8528 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.