Malicious PDF — malware analysis report

Static analysis result for SHA-256 d016feb3191c438b…

MALICIOUS

PDF

36.1 KB Authoring application: LibreOffice Draw
MD5: 94d43bf1c3112c41ed7053d38674be6f SHA-1: 7d2895c0ee3dd399349edaf3e31b18938eb51089 SHA-256: d016feb3191c438b98e7043c60ee16802543fa8102e63c8fff5d666c5e34648e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm designed to manipulate search engine rankings or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.photoprintservices.co.uk/uploads/1/3/0/5/130589427/dafewiz_nuwibitun_fejofosexul.pdf
    • http://soulstarmassage.com/uploads/1/3/0/6/130621248/540428.pdf
    • http://coopstraining.net/uploads/1/3/0/3/130313729/3c469.pdf
    • http://opergal.org/uploads/1/3/0/3/130313436/gewoxu-zogasiziri-zajaniseso.pdf
    • http://solecobbler.com/uploads/1/3/0/7/130738542/1d1a0.pdf
    • http://getjackedtrucking.com/uploads/1/3/0/8/130874470/zolore-sejumevukijek-mirew-verulolu.pdf
    • http://missionbeachaustralia.com/uploads/1/3/0/7/130775866/basipewa.pdf
    • http://botoxalpharetta.com/uploads/1/3/0/7/130739879/97d91.pdf
    • http://mythinkando.com/uploads/1/3/0/2/130273791/ranoseruzili_rixar.pdf
    • http://www.beyondplans.info/uploads/1/3/0/7/130776201/3b3089168b87b.pdf
    • http://lahaina-accommodations.net/uploads/1/3/0/7/130740173/9348415.pdf
    • http://daily-antiquing.com/uploads/1/3/0/6/130621751/ponudenojaguweme.pdf
    • http://laurawanamakerdoulas.com/uploads/1/3/0/6/130639077/rudiri.pdf
    • http://jhoannaroa.com/uploads/1/3/0/6/130639114/5174082.pdf
    • http://www.bmmaa.net.au/uploads/1/3/0/7/130738632/zaxagizigusedagavoj.pdf
    • http://bcsinmoohapkido.com/uploads/1/3/0/5/130539270/5145231.pdf
    • http://pureandsimpletruthforyouth.org/uploads/1/3/0/2/130272271/4206243.pdf
    • http://biopacificmexico.com/uploads/1/3/0/3/130313212/kuloralu_wuxuzereruk.pdf
    • http://johnhancockcenterchicago.com/uploads/1/3/0/6/130604896/fefavuda.pdf
    • http://katherinemunster.com/uploads/1/3/0/4/130488414/gevubuxanoninan.pdf
    • http://www.annequigghealing.com/uploads/1/3/0/5/130590353/1436504.pdf
    • http://oj1ixg.bdgct.com/uploads/1/3/0/6/130604962/130604962.html#behaviourism+skinner+and+pavlov

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fad.bin
2d9f24a9938d5ffcf0b66bb988e1fcd62a754feacceb53ed80c9f375826e6617		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FAD 6728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.