Malicious PDF — malware analysis report

Static analysis result for SHA-256 ddb5962ab906447f…

MALICIOUS

PDF

43.4 KB Authoring application: LibreOffice
MD5: 64f5094f7b62b649887ece8e1285e087 SHA-1: f7b345747505cf752b1b5f72c8d4302c20c9ad86 SHA-256: ddb5962ab906447fc71cef5ed2d7f0f72854b96092bbdf671943e4d0af28e69d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files, a technique commonly used for SEO poisoning and phishing. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing intent. The document body, disguised as educational material, contains these links, aiming to trick users into downloading further malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://faz.dns-oldi-nix.info/uploads/2020/01/28/f73af13ea05ce73.pdf
    • http://meteorcrater.us/uploads/1/3/0/6/130604441/fosulaxu.pdf
    • http://habitmkr.com/uploads/1/3/0/7/130739607/1847576.pdf
    • http://suzanneandjustinforever.com/uploads/1/3/0/4/130483783/2057055.pdf
    • http://mokapuelem.org/uploads/1/3/0/4/130476976/kumepaxutafegu_dimezoga.pdf
    • http://charlestonmanufacturingcenter.com/uploads/1/3/0/3/130379173/kiwikuvozimop-kozuxefirogiz.pdf
    • http://333tools.com/uploads/1/3/0/7/130739269/potatadefatime_zakitivij_dinizozamo.pdf
    • http://natashastraley.com/uploads/1/3/0/4/130477287/1155082.pdf
    • http://aspiretogetherforum.org/uploads/1/3/0/6/130621812/kafupulusovuzen-vazokufuv-zibupadeze.pdf
    • http://bnaiisraelnc.com/uploads/1/3/0/5/130539002/2222061.pdf
    • http://hello-baby-toys.com/uploads/1/3/0/5/130538986/130538986.html#6th+grade+math+integer+worksheets

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012ae.bin
d90cc412d01169acdd2d80c0de9b570d2168772c8cadccd205411aee40a42413		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12AE 8296 bytes
font_01_sfnt_off00006ee4.bin
e2f1373bf3d70a40ff4276a486f0a1d2d32154e4f45ad1243a44c3d3b7d91cea		 pdf-font-stream PDF embedded font (sfnt) at offset 0x6EE4 2652 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.