PDF malware analysis — malicious · 3e1140b8358016a4

MALICIOUS

PDF

46.1 KB Authoring application: LibreOffice Draw

MD5: 6d214aea9d3c9af97e2343e9306df4d3 SHA-1: 159839a542130c86b080f0d5ca7c94e8ec6e75c2 SHA-256: 3e1140b8358016a4150ac6062ed6ca1a3d4a19d81595b89cee6b50f0fefaf632

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a phishing campaign designed to redirect users to potentially malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing classification. No scripts were extracted from this sample, and the document body was heavily obfuscated.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://nblbball.com/uploads/1/3/0/4/130435574/movizo-wevoposipa-ramedowibideniv-betobifuwili.pdf
- http://printroom231.com/uploads/1/3/0/4/130489342/2213494.pdf
- http://loudfitness1.com/uploads/1/3/0/4/130435813/subumojefirosozuvira.pdf
- http://theladyofthestones.com/uploads/1/3/0/2/130271080/526495.pdf
- http://kincalding.pro/uploads/2020/01/29/95c88.pdf
- https://rufawilezu.weebly.com/uploads/1/3/0/3/130313755/2291235.pdf
- https://wuzapojik.weebly.com/uploads/1/3/0/2/130272102/jigewasawezagu.pdf
- http://tovarioseni14.fun/uploads/2020/01/29/bd395279e79.pdf
- http://goodbreak.ru/uploads/2020/01/28/juvinulimetoxefev.pdf
- http://limitlesslawnsprinklers.com/uploads/1/3/0/3/130323377/fadifuta_bojemupode_rejujif_direwedumuseli.pdf
- http://radiantlifeacademy.org/uploads/1/3/0/6/130604595/zuratidikubeweziwote.pdf
- http://ivgpu.ru/uploads/2020/01/28/7999705.pdf
- http://jupej.la-mebel-modern.ru/uploads/2020/01/29/dec911a81125c71.pdf
- http://lakepointboatrentals.com/uploads/1/3/0/2/130288775/8214907.pdf
- http://ninamire.com/uploads/1/3/0/3/130379590/6a32a.pdf
- http://kuprygin.com/uploads/2020/01/28/dozudawemuvojido.pdf
- http://resurgent-house.com/uploads/1/3/0/6/130621928/2960715.pdf
- http://victoriajsmith.com/uploads/1/3/0/4/130491319/denejop-felukuborak-saxafubi.pdf
- http://mjstead.com/uploads/1/3/0/5/130538902/sirubifarapavo.pdf
- http://doug-jones.com/uploads/1/3/0/4/130435581/janewemevoj.pdf
- https://babiporidaxo.weebly.com/uploads/1/3/0/2/130270905/nelasifutanatarup.pdf
- http://ridevs51.com/uploads/1/3/0/5/130541271/nipipowoje.pdf
- http://paulsmusicacademy.com/uploads/1/3/0/6/130621960/sukava.pdf
- http://aksvinfotech.com/uploads/1/3/0/4/130488780/98c61cdf0e.pdf
- http://whitele.com/uploads/1/3/0/5/130551349/ritetililaluli-tolaxawemebil-gorawa.pdf
- http://nobuhotelriyadh-fullsite.devsite-1.com/uploads/1/3/0/3/130312972/130312972.html#dynamics+physics+problems+and+solutions+pdf
- http://whitele.com/uploads/1/3/0/5/130551349/ritetililaluli-tol

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000197c.bin` `23fc1e3e885491e19fa5dde007f560d6a172a1726addb29abf007296ca7829ae`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x197C	8700 bytes
`font_01_sfnt_off000077bb.bin` `985cbd9ba5b629f1b749d04d852c0eecb5d8ad374186a1044a60da9476420dc6`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x77BB	2788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.