Malicious PDF — malware analysis report

Static analysis result for SHA-256 3a196dcda50452df…

MALICIOUS

PDF

42.0 KB Authoring application: LibreOffice
MD5: 186d9ad892d980f811b727df3f1e7bda SHA-1: 819d24aaf61607de984627798e022af202be62a6 SHA-256: 3a196dcda50452df3ee342c86cafbadec92f943af1c9d983428dcdd37e84dcd5
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded links to other PDF files, a technique commonly used for SEO poisoning or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the heuristic 'PDF_SEO_LINK_FARM' strongly indicate a phishing or malware distribution attempt. The document body, though heavily corrupted, contains references to antivirus software, likely a lure to encourage downloads.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thecolororacle.com/uploads/1/3/0/5/130588749/8392328.pdf
    • http://wob4000.com/uploads/2020/01/28/fovudega_mazukapar.pdf
    • http://sweetpeasdreamzzz.com/uploads/1/3/0/3/130313070/5981410.pdf
    • http://whatyouwantcreations.com/uploads/1/3/0/5/130551279/6819989.pdf
    • http://decojewelry.net/uploads/1/3/0/5/130539697/696adc680239230.pdf
    • http://newdirectionintlmin.com/uploads/1/3/0/4/130483477/b2fa2f5d8e7d3.pdf
    • http://loguzepedi.conceptfashionfest.ru/uploads/2020/01/29/nivose.pdf
    • https://vonidumog.weebly.com/uploads/1/3/0/5/130551219/758710.pdf
    • https://wagesozowu.weebly.com/uploads/1/3/0/4/130483872/fegov.pdf
    • http://rujoj.cargo-floor.ru/uploads/2020/01/28/katuvagudejit_raxivari_zitinob_fotaviz.pdf
    • http://runwildandbe.com/uploads/1/3/0/6/130621153/sovowalomuzif_podufakukib.pdf
    • http://odessawaterwell.com/uploads/1/3/0/5/130550929/xoralizunideda.pdf
    • http://humannaturefoundation.com/uploads/1/3/0/5/130541924/932deb2d77.pdf
    • http://aahardwood.com/uploads/1/3/0/2/130289363/7927224.pdf
    • http://missfass.com/uploads/1/3/0/5/130588343/polidoxelenanis_toselebidu.pdf
    • http://michaelazoe.com/uploads/1/3/0/6/130621127/lisiweju_pusuxivade_votepapewanudo_kutulafepi.pdf
    • http://mightymustangband.com/uploads/1/3/0/3/130323709/846090.pdf
    • http://suekodress.com/uploads/1/3/0/6/130605165/xixal.pdf
    • http://stjohnvianneymorisset.com/uploads/1/3/0/3/130324340/gomij.pdf
    • http://cyclebavaria.com/uploads/1/3/0/5/130588445/130588445.html#antivirus+avast+64+bit

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000015c2.bin
0a0970a006719297815f9ff5a04a1d8d56e67974d7a68914ff854b92fafe2cd6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x15C2 8728 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.