PDF malware analysis — malicious · 20a9cec6e81e285b

MALICIOUS

PDF

40.5 KB Authoring application: LibreOffice

MD5: 51926f9e3ffa97c090ddbe3b6b4bdf91 SHA-1: beec422693611ff5c43535f7893e2781e45b7b95 SHA-256: 20a9cec6e81e285be88a698c6499b8d55c001a301400ef5a6e870adeed9e8e09

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by ClamAV with the signature Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a critical heuristic firing for PDF_SEO_LINK_FARM, indicating the presence of 31 external PDF links. The dominant host for these links is www.swayecapitale.com. The document body is heavily obfuscated and does not provide clear user-facing text, but the sheer volume of external links strongly suggests a phishing or malware distribution campaign.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://www.swayecapitale.com/uploads/1/3/0/4/130494636/8041b9c.pdf
- http://blakeconway.com/uploads/1/3/0/8/130814967/nezodisataguwid-jazefekoxaxe.pdf
- http://mail.danceclosetboise.com/uploads/1/3/0/6/130605077/bijov.pdf
- http://clogdancing.us/uploads/1/3/0/4/130483478/6322868.pdf
- http://starwarscamps.com/uploads/1/3/0/7/130738951/luzut-panigofudofow-pawakajo.pdf
- http://workplaemassagetherapy.com/uploads/1/3/0/6/130604878/6883269.pdf
- http://napalmquist.com/uploads/1/3/0/6/130640091/sakimove.pdf
- http://www.realearlgrey.com/uploads/1/3/0/6/130621985/9717467.pdf
- http://webmail.fastparcel.net/uploads/1/3/0/7/130775221/jafivogurenori-julivape-butipu.pdf
- http://guide2pifs.com/uploads/1/3/0/5/130541677/887da3.pdf
- http://sideshowmarketing.net/uploads/1/3/0/6/130603995/repujekofemifusoj.pdf
- http://stagfish.com/uploads/1/3/0/2/130272296/zunisilolasim.pdf
- http://coolmanhaulage.net/uploads/1/3/0/6/130620416/3702602.pdf
- http://salgadosgourmet.net/uploads/1/3/0/4/130435598/907225.pdf
- http://mx.lbnlex.com/uploads/1/3/0/6/130639743/davuxorome.pdf
- http://www.northlight.lv/uploads/1/3/0/6/130604425/9568241.pdf
- http://mrstodd.net/uploads/1/3/0/7/130739656/1186667.pdf
- http://effectiveinfotech.com/uploads/1/3/0/5/130538925/dugupo.pdf
- http://soulsuccess.com.au/uploads/1/3/0/8/130874066/bilalamatuge.pdf
- http://canichecouture.com/uploads/1/3/0/4/130492127/mosebobadaxi.pdf
- http://laceyandleatherexoticattirellc.com/uploads/1/3/0/4/130476054/delepivinawi-lokigegasezepi.pdf
- http://standoutindallas.com/uploads/1/3/0/5/130543207/b11a2561.pdf
- http://www.georgedudley.net/uploads/1/3/0/5/130540209/gejukiga.pdf
- http://hostmaster.hill-morriss.com/uploads/1/3/0/7/130775339/53cdc2.pdf
- http://stovewiseofcheshire.co.uk/uploads/1/3/0/4/130488483/1908323.pdf
- http://xstreamspecial.xsideas.com/uploads/1/3/0/7/130740419/130740419.html#ukulele+chords+songs+landslide

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off00002e1a.bin` `3d52fc27d04b8b84b219df719738f768697e09c2050136bc1fe69fcddf4eca6e`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x2E1A	2652 bytes
`font_01_sfnt_off000039fc.bin` `9bb0da7d058617dbf3e5db7c815fe2ce4f7c3119f3287d1025e25fe98b9cf973`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x39FC	7784 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.