Malicious PDF — malware analysis report

Static analysis result for SHA-256 314f7f989ed52d56…

MALICIOUS

PDF

44.5 KB Authoring application: QPDF
MD5: f0ae5b8479d87f93f08428b011beae20 SHA-1: f8683b8d00d8c676130cbb25dabaa730a7610353 SHA-256: 314f7f989ed52d56fb86f3bd3c8442461f80af301d848c7191b3a505b6b0b4d6
130 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of external links, many of which are hosted on domains that appear to be part of a link farm. The heuristic 'SE_INVOICE_LURE' indicates that the document's content is designed to resemble an invoice or payment request, further supporting a phishing or social engineering attack. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' confirms the malicious nature of the file, likely related to traffic redirection or phishing.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Fake invoice / payment lure low SE_INVOICE_LURE
    Document contains invoice or payment language paired with an action verb — useful context when combined with link, macro, or attachment indicators
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dramaclubplays.com/uploads/1/3/0/6/130605204/dirogofa-vebedosugepuxo-ruwazetiwibu-benakep.pdf
    • http://saccma.org/uploads/1/3/0/6/130604238/sukogisunivudus-pomojawav-lunaxe-wogisemutikodi.pdf
    • http://iqseries.de/uploads/1/3/0/5/130552097/7ff2f392b0b4.pdf
    • http://contentmentcoaching.org/uploads/1/3/0/2/130287992/topajukokobimoz-nilovuz-bavejezug-vesozaxefa.pdf
    • http://thephenomenallife.com/uploads/1/3/0/3/130313454/vebapuzule-nudebavo-kimer.pdf
    • http://us.momotombochocolatefactory.com/uploads/1/3/0/2/130272360/130272360.html#budget+2018+in+gujarati+pdf+free

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001153.bin
59fb382ed8a4334686620ddf288d97049a4c8bdc5bcea92c47af42b2f2640dae		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1153 8512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.