Malicious PDF — malware analysis report

Static analysis result for SHA-256 c39874b5e83d1283…

MALICIOUS

PDF

44.6 KB Authoring application: OpenOffice.org
MD5: 920ee9454aef04a56ad96679dc55f444 SHA-1: 446693ff619ab1f2f7dfedb22ffdb8359f510e8a SHA-256: c39874b5e83d128394667244761ba0b5ef517e069078705e8e0df36ff2756f65
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection also flags it as phishing-related malware. No scripts were extracted, limiting the analysis of direct execution capabilities.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.mysticthisweek.com/uploads/1/3/0/6/130620848/lapadivesulemugop.pdf
    • http://perfect-customrims.com/uploads/1/3/0/5/130539820/7950351.pdf
    • http://votebyronmartin.com/uploads/1/3/0/5/130550708/dinedolurekuk_jepovis_voteveriz_kinezujolukote.pdf
    • http://ms-j.org/uploads/1/3/0/3/130379921/pokep_jorepe.pdf
    • http://blindsquirrelcreativedesign.com/uploads/1/3/0/7/130775376/pofew.pdf
    • http://proximal50.net/uploads/1/3/0/6/130639906/5c92fcd45ce5.pdf
    • http://pluscarts.com/uploads/1/3/0/6/130640060/bikowinob_dolurojujax_kokidinevigoti.pdf
    • http://watc2018.com/uploads/1/3/0/3/130379503/fidukedaki-motod-kenowutiveva.pdf
    • http://oakislandhomeowners.org/uploads/1/3/0/5/130543289/zowogulevesina_wowudinigin.pdf
    • http://orchid-avenue.net/uploads/1/3/0/7/130776791/324de7a93c2.pdf
    • http://www.mesaroofingcompany.net/uploads/1/3/0/2/130287495/5186832.pdf
    • http://gognome.us/uploads/1/3/0/7/130739363/gopizejigowug_riwujenobus_boziborep.pdf
    • http://jennyss.com/uploads/1/3/0/6/130605331/tuganavujasavazit.pdf
    • http://salon626.net/uploads/1/3/0/7/130739002/86c9b5bc7dfa.pdf
    • http://brisbanebirthing.com/uploads/1/3/0/2/130270985/ritosode_nozujipebig.pdf
    • http://aninconvenientcommute.com/uploads/1/3/0/8/130813496/nuzux.pdf
    • http://naplesmarketresearch.com/uploads/1/3/0/7/130775156/kopixezok-vokij.pdf
    • http://creartivemedia.com/uploads/1/3/0/7/130775231/3502ffa8.pdf
    • http://hostmaster.beachkick.de/uploads/1/3/0/2/130272458/6065247.pdf
    • http://happyvids.com/uploads/1/3/0/6/130604525/4027116.pdf
    • http://www.ahtiras-africa.com/uploads/1/3/0/9/130969997/pujovura.pdf
    • http://74-123-77-218.mgwnet.com/uploads/1/3/0/2/130289063/130289063.html#spontaneous+generation+vs+biogenesis+quizlet
    • http://gognome.us/uploads/1/3/0/7/130739363/gopizejigowug_riwujen

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004ed6.bin
64366f50d2b6300e352a1fd6296a78bcdf32f3f4ce7a583d641cad24868d05df		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4ED6 7684 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.