Malicious PDF — malware analysis report

Static analysis result for SHA-256 c1efe5fb3620e741…

MALICIOUS

PDF

44.6 KB Authoring application: OpenOffice.org
MD5: 150740bcc3433047fd689badeb8ab2b9 SHA-1: 7d21bc819ebb4ad64c9fef3a1fc628cdf9bb7b6a SHA-256: c1efe5fb3620e741998c906359999819e6e5190d4032a2dbeb755d73cce902bd
180 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDFs, a technique often used for SEO poisoning or to redirect users to malicious sites. The document body also contains text related to bank routing numbers and payment redirection, consistent with a business email compromise or financial scam. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall' further supports a phishing or malicious redirection intent.

Heuristics 5

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Payment redirection / bank-detail change lure high SE_PAYMENT_REDIRECT_LURE
    Document describes new or changed bank, wire, ACH, IBAN, SWIFT, or routing instructions — a high-value business-email-compromise pattern
  • Callback phishing phone lure medium SE_CALLBACK_LURE
    Document asks the user to call a phone number in billing, refund, subscription, fraud, or security context — consistent with callback phishing or tech-support scam patterns
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wesanewagu.begone-dumps.store/uploads/2020/01/29/jotokuvozufulofug.pdf
    • http://kodubudiv.tv-android.ru/uploads/2020/01/28/506603.pdf
    • http://believe-in-good-food.nl/uploads/1/3/0/5/130590714/fazovovurowaro.pdf
    • https://wapuravedowewef.weebly.com/uploads/1/3/0/6/130604947/mobotik-dativinuxafa.pdf
    • http://pevibakak.portbreton.com/uploads/2020/01/28/9381146.pdf
    • https://nixitowebegube.weebly.com/uploads/1/3/0/2/130272496/nimamusofigekele.pdf
    • http://kidsphilharmonic.com/uploads/1/3/0/5/130544313/vosakidowumun.pdf
    • http://puremsm.com/uploads/1/3/0/3/130379634/gugisaguza.pdf
    • http://burnsblufflodgeathighfalls.com/uploads/1/3/0/6/130605397/zeromarak_nilitojazo.pdf
    • http://randallsprague.com/uploads/1/3/0/2/130289763/jabiburuv-kesovuz-zajefibovidifet.pdf
    • http://suxiwe.antizavtra.ru/uploads/2020/01/27/zizuposanipa.pdf
    • https://vawirogogulop.weebly.com/uploads/1/3/0/5/130547969/e37bcbd0.pdf
    • https://jufegojero.weebly.com/uploads/1/3/0/2/130288316/legisetapixure_tanolezomiwet_jutediludurokot_wisuxafi.pdf
    • http://fintracker.ru/uploads/2020/01/28/9916160.pdf
    • http://augustahousekeeping.com/uploads/1/3/0/5/130551002/8373669.pdf
    • http://nabo.remont-msk9.icu/uploads/2020/01/27/e8a12305f9a60.pdf
    • http://zoxamewek.telelistamg.com/uploads/2020/01/29/16c9b.pdf
    • http://kuhni-msc12.icu/uploads/2020/01/29/pogot.pdf
    • http://lutefiskuniversity.com/uploads/1/3/0/4/130435500/wetubosiwer-femefejurovi-zikopoxumubeb-vofobakem.pdf
    • https://sivoluregefep.weebly.com/uploads/1/3/0/4/130476389/9722050.pdf
    • http://zasotasev.bestshop10.ru/uploads/2020/01/29/zidolobejok_xugofewu_zumisi_fibukoluj.pdf
    • http://sos.diet-helper.club/uploads/2020/01/27/9737829.pdf
    • http://gezo.retinuelk.org/uploads/2020/01/27/5a8cf165.pdf
    • http://wikadefa.studio-elephant.ru/uploads/2020/01/27/lodasubapozanaga.pdf
    • http://beingself-centered.com/uploads/1/3/0/2/130272095/130272095.html#wallis+state+bank+routing+number
    • http://gezo.retinuelk.org/uploads/2020/01/27/5a

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000017bf.bin
b97dd7dac9cbe59327ceb856b0d528d6ba7a1cdfcd447e617300fc2fb5717761		 pdf-font-stream PDF embedded font (sfnt) at offset 0x17BF 7820 bytes
font_01_sfnt_off00006721.bin
6db2f878e0fd57d3a351d0d81a5ccd7b58f68df6728dadc3aee3ebeb1a1d6e60		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6721 16068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.