Malicious PDF — malware analysis report

Static analysis result for SHA-256 d6fc2626ad4338ad…

MALICIOUS

PDF

29.6 KB Authoring application: OpenOffice.org
MD5: 53e8c660bec42bccf239d096d60385a6 SHA-1: 5d981f2c65710ab34220f33404470bc7c7156fc4 SHA-256: d6fc2626ad4338add7606e3da693d72f759ae8042057d34e91570143324c5838
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents, indicative of a link farm or phishing lure. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. The document body itself is heavily obfuscated but contains many of the same URLs, reinforcing the attack pattern.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://campkennedy.com/uploads/1/3/0/4/130477882/xejubufetere.pdf
    • http://19500vermont-jp.com/uploads/1/3/0/6/130603971/e9895cbaa443c0e.pdf
    • http://bassporshop.com/uploads/2020/01/27/3c8c3bde3.pdf
    • http://tarezewapa.prontoconsegna.it/uploads/2020/01/28/8834156.pdf
    • http://piv.nhatminhphoto.online/uploads/2020/01/28/warerabobemola.pdf
    • https://nigudesamad.weebly.com/uploads/1/3/0/3/130379523/8936070.pdf
    • http://jenniferbelphotography.com/uploads/1/3/0/4/130492963/e59afacc.pdf
    • http://paulbutlerusa.com/uploads/1/3/0/6/130639706/muxuziruraw_begub.pdf
    • http://juxopupoj.baikalist.com/uploads/2020/01/29/7d51c3.pdf
    • http://welovekurtcobain.com/uploads/1/3/0/3/130379411/f9a365f04b5.pdf
    • https://sowajivida.weebly.com/uploads/1/3/0/5/130550926/1301612.pdf
    • http://suxepa.lada-detail.net/uploads/2020/01/28/2609179.pdf
    • http://mhsdoernbecher.com/uploads/1/3/0/2/130272880/d9cfd4.pdf
    • http://woodlandstuition.com/uploads/1/3/0/5/130551375/130551375.html#ringtones+love++2019

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001294.bin
8f3818279f80cc99a949beb756e1b24c6317d8baa11244da7366959fdd19807b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1294 6720 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.