Malicious PDF — malware analysis report

Static analysis result for SHA-256 391e219d6448b7b9…

MALICIOUS

PDF

41.3 KB Authoring application: OpenOffice Draw
MD5: 61278decae973b7cd1cd998e9948ab3c SHA-1: fd130d9528cc0ba0defb60a02133e0b4e8cef056 SHA-256: 391e219d6448b7b90bb798bebb19fa1d0ac876852303f4af704da5c3468bed7b
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link T1059.001 PowerShell

The PDF file contains an embedded JavaScript stream and a large number of external PDF links, indicating a phishing or SEO manipulation attempt. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. The embedded JavaScript likely facilitates the redirection to these external links, which are designed to appear as legitimate documents but likely lead to malicious content or further phishing attempts.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mamatriberva.com/uploads/1/3/0/2/130288492/jogavowotepiniw.pdf
    • http://myasia.com.my/uploads/1/3/0/6/130621046/ruzimegomegeja.pdf
    • http://naderafzalan.com/uploads/1/3/0/6/130639815/jirupar.pdf
    • http://www.sense-mindful.com/uploads/1/3/0/8/130813797/sonukusenixip.pdf
    • http://www.lovedanceyogarelax.com/uploads/1/3/0/2/130289655/d102d.pdf
    • http://mail.sparklesandspitballs.com/uploads/1/3/0/6/130620653/9452512.pdf
    • http://theprocessconspiracy.com/uploads/1/3/0/8/130813509/8256060.pdf
    • http://www.richardsrenovations.alesiagriffin.net/uploads/1/3/0/4/130488469/gogiw.pdf
    • http://thepacketpusher.net/uploads/1/3/0/7/130776405/9905450.pdf
    • http://goodvibeitems.com/uploads/1/3/0/5/130543353/tilakes-fefagefaloko.pdf
    • http://probuildteam.com/uploads/1/3/0/6/130621176/nedosiwakikevigube.pdf
    • http://neworleans-homeinspections.com/uploads/1/3/0/2/130272428/sevaforajitet.pdf
    • http://mylaurabelle.com/uploads/1/3/0/4/130488416/fe936e46c.pdf
    • http://tiffanyhairsalon.com/uploads/1/3/0/5/130541765/voboxewogujulufejeb.pdf
    • http://mta-sts.mx.trishhermanson.com/uploads/1/3/0/6/130639019/zitoxe_xirexuvepu.pdf
    • http://vestmoglobal.com/uploads/1/3/0/5/130543985/zamozuvelusaxilikuku.pdf
    • http://mybrookfield.org/uploads/1/3/0/6/130640023/josipumowak.pdf
    • http://www.micabotanicals.com/uploads/1/3/0/5/130590235/130590235.html#concepto+tratamiento+pdf
    • http://mta-sts.mx.trishhermanson.com/uplo

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000041cf.bin
e4df31a3b17036f707e84b36a6920de03402fc1ff70af8188a3824fae0a8f9d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x41CF 9632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.