Malicious PDF — malware analysis report

Static analysis result for SHA-256 e78c1970ccbeb0f3…

MALICIOUS

PDF

45.4 KB Authoring application: OpenOffice.org
MD5: 4ed8a9b0ded43f285a88004b30d5cfbf SHA-1: b97a3934397f925884f9111486936cc5a117521b SHA-256: e78c1970ccbeb0f375e25a3fb43a3920d0e899364a76d47812cd3a502414e6f9
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mostlytech.com/uploads/1/3/0/3/130313368/2137543.pdf
    • http://rebeccahoulden.com/uploads/1/3/0/5/130551019/fofajexegitiwevo.pdf
    • http://txkicks.shop/uploads/1/3/0/3/130313286/nepixutomom.pdf
    • http://garypatrickyoga.com/uploads/1/3/0/2/130287211/doxum_gitasokigaxe.pdf
    • https://wexikedot.weebly.com/uploads/1/3/0/2/130271226/jurijafarivagojig.pdf
    • http://therealtyfinder.com/uploads/1/3/0/7/130776358/6235491.pdf
    • http://cristawadsworth.com/uploads/1/3/0/2/130289504/segobulagefuw-xuvuxejevav-goburu.pdf
    • http://dreambiztestdrive.com/uploads/1/3/0/6/130621591/zegibikid_mivevawikeludaz_nevoxegafuxuz_sufekilo.pdf
    • http://duruzex.slavbul15.ru/uploads/2020/01/28/gejelawajif-joton-xawekexeb-jalobutiwo.pdf
    • http://nolabeke.tvmiyouka.com/uploads/2020/01/28/367067.pdf
    • http://mountaincreeklodging.com/uploads/1/3/0/4/130476491/9770749.pdf
    • http://miami.momotombochocolatefactory.com/uploads/1/3/0/5/130588772/130588772.html#infection+prevention+and+control+questions+and+answers

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001371.bin
6d224e973db2ac25c2c12ffe63fcd4887a729f511185f4df0b66ef699658b3fc		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1371 8160 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.