Malicious PDF — malware analysis report

Static analysis result for SHA-256 240867653e7a4e41…

MALICIOUS

PDF

65.8 KB Authoring application: OpenOffice.org
MD5: 416075ca1ac20bc4ce3cd231a75fa1a3 SHA-1: 4795ded8273927d22b216b422ba3c8b197d389bb SHA-256: 240867653e7a4e410e6893b983ec884b0db728ad3267b139430c25612e4420ec
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

This PDF file contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection also flags it as phishing-related. The embedded URLs point to various domains, suggesting a link farm designed to redirect users to potentially malicious content. The document body text is largely garbled and does not provide further context.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://cottonginmuseum.org/uploads/1/3/0/6/130639549/9592299.pdf
    • http://45northfarm.com/uploads/1/3/0/5/130588500/zozewemufedokot-samow-nuneninoxa.pdf
    • http://smgoldrup.com/uploads/1/3/0/4/130476339/5fe54392bb12ca2.pdf
    • http://metricsteelnyc.com/uploads/1/3/0/7/130740512/0f4c32bb280e65f.pdf
    • http://liveinemail.net/uploads/1/3/0/4/130488829/9c2b15ce4838aae.pdf
    • http://tnpcdc.org/uploads/1/3/0/4/130488217/7014227.pdf
    • http://mybuildahome.com/uploads/1/3/0/5/130538831/jaxukananoga.pdf
    • http://aireenp.com/uploads/1/3/0/5/130590594/a03824e9708.pdf
    • http://meddin.space/uploads/1/3/0/6/130639488/sotep_tofese.pdf
    • http://5pointauto.com/uploads/1/3/0/7/130739024/130739024.html#depreciation+expense+reported+on+the+balance+sheet

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012aa.bin
f044a14f282de80eab45b2b7f0b4e89fa300efe7aa272d2511161791a13e8b1f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12AA 8760 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.