Malicious PDF — malware analysis report

Static analysis result for SHA-256 c14854199838380c…

MALICIOUS

PDF

40.6 KB Authoring application: OpenOffice Draw
MD5: 4ea430bb020c9348c77bb63b7a21e736 SHA-1: 003ae5e03712665a119d99f62579bc475e1fc7ed SHA-256: c14854199838380c7bcd37c6621c041839d1700bff4f6f53684c52fec3b9682a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO poisoning or phishing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. The document body itself is largely unreadable due to encoding issues but contains references to 'Admiralty island fishing report', suggesting a lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://snli.co/uploads/1/3/0/2/130273791/543057.pdf
    • http://branchlutheranschoolshaiti.com/uploads/1/3/0/2/130270849/lopudurevurojasad.pdf
    • http://fas.bikinimag.ru/uploads/2020/01/27/7058057.pdf
    • http://kelseycurrent.com/uploads/1/3/0/6/130604771/843e4d66df435.pdf
    • http://matchboxorganics.com/uploads/1/3/0/5/130551714/9730153.pdf
    • http://kibov.remont-msk6.icu/uploads/2020/01/28/rigotumakenexe.pdf
    • http://nathanrpt.com/uploads/1/3/0/2/130289399/xilosoxa-lolozoxiwap.pdf
    • http://iloveacorns.com/uploads/1/3/0/5/130541924/popavazuse_witib_ridotipiwe.pdf
    • http://aislingnaysmob.com/uploads/1/3/0/5/130543453/0b0ce.pdf
    • http://kissbotr.com/uploads/1/3/0/2/130270847/fafovesozuzetaroj.pdf
    • http://zenwich.co/uploads/1/3/0/4/130489075/a3a29462114505.pdf
    • http://argusbuildingservices.com/uploads/1/3/0/2/130289532/jutiwapidif.pdf
    • http://monaventurephoto.com/uploads/1/3/0/3/130379743/efa6c309ed79bd3.pdf
    • http://thecockapooclick.com/uploads/1/3/0/5/130550743/5a2345a748aa.pdf
    • http://ownyourlinemtb.com/uploads/1/3/0/5/130550818/kaveromatil-gomowemofatira-bofoza.pdf
    • http://lasthit.eu/uploads/1/3/0/5/130551464/zitegu_vegaxijefekipe_vodomusogokokes.pdf
    • http://anaistorephotographie.com/uploads/1/3/0/2/130287445/vunajev.pdf
    • http://mycreativecontributions.com/uploads/1/3/0/6/130639848/7f21491f36f1.pdf
    • http://dotekob.vidracariaartvidros.site/uploads/2020/01/29/8204c.pdf
    • http://neurohorizonpharma.com/uploads/1/3/0/2/130270872/7719781.pdf
    • http://drpatty.net/uploads/1/3/0/4/130483351/130483351.html#admiralty+island+fishing+report

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001631.bin
8a8460bcaa304678dcfe3cf12ff66fd7e3a5ab96b2b1e8411261e64722f19e7f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1631 8728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.