Malicious PDF — malware analysis report

Static analysis result for SHA-256 eea9288c61df70a7…

MALICIOUS

PDF

56.4 KB Authoring application: LibreOffice Draw
MD5: 8ce4c40ae6b1b9fce705661f3f73e8ea SHA-1: 7d231de457be59f40b3a69869a7858e56af7f73e SHA-256: eea9288c61df70a79e05043454dfd583e71686170ac56d838fdc8b9e7b21f39d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, a common technique for SEO poisoning or redirecting users to malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://elizabethgoldsteinphd.com/uploads/1/3/0/3/130379431/sapozem-piboj.pdf
    • http://capturingtheride.com/uploads/1/3/0/3/130313271/648513.pdf
    • http://motoadventure.club/uploads/1/3/0/6/130621035/tuzilul-badux.pdf
    • http://shopp-italia.fun/uploads/1/3/0/6/130639278/5645951.pdf
    • http://noahlang.net/uploads/1/3/0/4/130476917/ralarok.pdf
    • http://alexisborth.com/uploads/1/3/0/5/130543684/38eb02.pdf
    • http://uofuredcross.com/uploads/1/3/0/6/130639038/kolaramezibe-kizuw-pirili.pdf
    • http://spencerbarnor.com/uploads/1/3/0/6/130639411/zibabelaka.pdf
    • http://jahielworkshops.com/uploads/1/3/0/7/130739198/9190661.pdf
    • http://tigerlilyyoga.com/uploads/1/3/0/7/130776760/wibuwolitugotiwedav.pdf
    • http://train4safety.net/uploads/1/3/0/7/130739007/8074572.pdf
    • http://motticehammond2020.com/uploads/1/3/0/6/130639809/715bcb.pdf
    • http://host10.carmichaelnl.com/uploads/1/3/0/3/130323213/130323213.html#add+image+to+pdf+cell+itextsharp+c

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000053e9.bin
963940c1271cd613cacfb849dbd4541d38e3dae196d33944756f435861bc0603		 pdf-font-stream PDF embedded font (sfnt) at offset 0x53E9 8324 bytes
font_01_sfnt_off0000727d.bin
6620f639dafcaa4a9d2d51544556d9f7fb8445b840ffff24a811137dd78ae2e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x727D 21240 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.