Malicious PDF — malware analysis report

Static analysis result for SHA-256 f66a6d53cbd2b2c7…

MALICIOUS

PDF

37.9 KB Authoring application: LibreOffice Draw
MD5: 951e0b6f05acd0c7ddc981877bd38067 SHA-1: cbce4c1fa17d071d0f6d0f457df275aa59270689 SHA-256: f66a6d53cbd2b2c74ae8990888affd52b3793b15c8ab56d1aa540cb1d340aab3
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as flagged by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection further supports its malicious classification. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://rubyjoybook.com/uploads/1/3/0/5/130588878/foleret-tafoni-zinowolapigamo-sunifenoju.pdf
    • http://benjamindcrowe.com/uploads/1/3/0/7/130739076/risoziropo.pdf
    • http://customcateringco.com/uploads/1/3/0/5/130545557/5b42f5d.pdf
    • http://mohussain.com/uploads/1/3/0/6/130604604/wevetumejupef_sixosovikaj.pdf
    • http://proraters.org/uploads/1/3/0/2/130291676/ec7d49c1513979.pdf
    • http://babacoolpc.com/uploads/1/3/0/7/130738641/tolagasurinipizu.pdf
    • http://moschellaroberts.net/uploads/1/3/0/6/130620565/jisefipete.pdf
    • http://globalwaronchristmas.com/uploads/1/3/0/4/130476161/zemususatet.pdf
    • http://stagedoorproof.com/uploads/1/3/0/5/130551586/xisetot_zebenavigoj_bejupemarisiwow.pdf
    • http://adenta.bg/uploads/1/3/0/6/130620936/65d0a3.pdf
    • http://cypress-it.com/uploads/1/3/0/6/130620755/liwidenud.pdf
    • http://mobcentric.net/uploads/1/3/0/5/130588435/1235842.pdf
    • http://boundlesstours.com/uploads/1/3/0/2/130291582/bozilusitolo-wazaviza-vopiju-dineba.pdf
    • http://beaumonttennisacademy.com/uploads/1/3/0/2/130273589/mewoweviv.pdf
    • http://mytourphone.com/uploads/1/3/0/2/130288486/7f85982938fa4.pdf
    • http://www.zirconiaedu.com/uploads/1/3/0/6/130605108/6007045.pdf
    • http://aquariumtopaquaponics.com/uploads/1/3/0/5/130589229/231fa90a3f444c2.pdf
    • http://abraxasroots.org/uploads/1/3/0/6/130604198/130604198.html#benign+hypertension+with+chronic+kidney+disease+icd+10
    • http://aquariumt

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000038be.bin
932ae46ad926b42dfc027a93ca96ec8bf8b738214e970e9e6091dac1662a34e1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x38BE 7524 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.