Malicious PDF — malware analysis report

Static analysis result for SHA-256 d87fd24e3d4fd357…

MALICIOUS

PDF

35.1 KB Authoring application: OpenOffice Draw
MD5: 492fbca6c56e0f6586629a2fa5438de0 SHA-1: bdd27d64f1b55f4e711c8cbced5b24383a46f278 SHA-256: d87fd24e3d4fd357cd4ddcc7303590966abc3a205a17e8f83e1df08b88e4cddc
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This technique is commonly used for SEO poisoning or to distribute phishing content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and traffic redirection nature of this file. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://musclesandmimosas.us/uploads/1/3/0/4/130483096/netazi_wuwebonubabiz.pdf
    • http://mysticstudiosllc.biz/uploads/1/3/0/4/130435590/vanorewuzanola-zitex-mediwisuretulab-xebixegunoja.pdf
    • http://premierbeachfl.com/uploads/1/3/0/6/130603715/05d0f7.pdf
    • http://teaalchemymelbourne.com/uploads/1/3/0/6/130604996/9736177.pdf
    • http://www.heathcoteandherran.com/uploads/1/3/0/7/130740129/4cf145c1e.pdf
    • http://mercwellnessinc.com/uploads/1/3/0/5/130551483/vudolowovadowawes.pdf
    • http://hilltop-roti.co.uk/uploads/1/3/0/6/130603931/togaxamuta-fujaxizazap-ximenomajit.pdf
    • http://cliffordspeechlanguagereading.com/uploads/1/3/0/2/130289649/2223408.pdf
    • http://camillelacasse.com/uploads/1/3/0/5/130588702/16624c0f6.pdf
    • http://www.alabama-mediation.com/uploads/1/3/0/4/130483986/gaxev.pdf
    • http://timefreedomhustle.com/uploads/1/3/0/8/130874055/wewobopives.pdf
    • http://kysoentertainment.com/uploads/1/3/0/6/130604441/7752942.pdf
    • http://paghosts.com/uploads/1/3/0/6/130639513/01ab6c3bdc.pdf
    • http://teamgls.com/uploads/1/3/0/4/130488401/130488401.html#dsm+5+code+for+ptsd+chronic

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fde.bin
cc6b985223e92e750692bd9ed1706f4b45d936641c4dda7d76fe0fefca16d0a5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FDE 8040 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.