Malicious PDF — malware analysis report

Static analysis result for SHA-256 2004e4996415798b…

MALICIOUS

PDF

38.2 KB Authoring application: OpenOffice.org
MD5: 53b99d9de8de2f2bf499b4fdf2ef10df SHA-1: 04d81fc95e7e33a86fdebabab6c8e8d2343999e0 SHA-256: 2004e4996415798b5b2066a8814fff1e8e21f1672e81315e1ed0919d4ccfe279
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected by ClamAV as 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. Static analysis revealed a significant number of embedded external URLs, characteristic of a link farm designed to redirect users to potentially malicious content. The document body, though partially corrupted, contains references to these URLs, reinforcing the phishing or malware distribution intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://adperformancehorses.com/uploads/1/3/0/5/130545484/tobomigujamawup.pdf
    • http://filezu.borauto-vikingi.online/uploads/2020/01/28/retavulag.pdf
    • http://magazz1.fun/uploads/2020/01/27/tabiwomal_nafaf_debukeweru.pdf
    • http://2mdesignlab.com/uploads/1/3/0/4/130488734/3176538.pdf
    • http://alicemanganphd.com/uploads/1/3/0/4/130436071/fotowukuwedole_sigijutames_fopuzizuriw.pdf
    • https://juliposuba.weebly.com/uploads/1/3/0/3/130379098/2245708.pdf
    • http://approvemyscripts.com/uploads/1/3/0/2/130289580/bavifakob-pidofezifev-pemupatod.pdf
    • http://loskuatro20decalifornia.com/uploads/1/3/0/2/130274282/130274282.html#48+volt+to+24+volt+transformer

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001155.bin
08efd5265d9697a9a8e67338b2410093afafe689b54b288c76967db55d711318		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1155 8164 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.