Malicious PDF — malware analysis report

Static analysis result for SHA-256 3e87ee2ca90454a5…

MALICIOUS

PDF

44.1 KB Authoring application: Smallpdf Desktop
MD5: d3a8e47ddeb9d64010202afbce4b80aa SHA-1: 2da3499de813c2ef5064292222deec0375b93b14 SHA-256: 3e87ee2ca90454a5cf4488f006e890af7ec18971a0264fa622db22d1bca8a631
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. ClamAV also detected this file as Pdf.Phishing.TtraffRobotInstall, indicating a phishing or traffic-driving intent. The document body, though partially corrupted, mentions 'how to write a cv and cover letter', suggesting a lure to disguise the malicious link distribution. The primary attack pattern involves directing users to a large number of external URLs.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Urgency / deadline lure low SE_URGENCY_LURE
    Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lezomav.glavmoskuhni.ru/uploads/2020/01/29/b07a49718305c3c.pdf
    • http://legacycreekgsmd.com/uploads/1/3/0/5/130589308/3e30bee5b91f21a.pdf
    • http://4100expressave.com/uploads/1/3/0/6/130604209/4610659.pdf
    • http://dupunanexa.dfd.ru/uploads/2020/01/28/vaxativuxalat.pdf
    • http://realmorrowpost.com/uploads/1/3/0/6/130639026/af55deca85.pdf
    • http://xomeloku.cityglush13.icu/uploads/2020/01/27/8b082f8.pdf
    • http://keepyourappointment.com/uploads/1/3/0/5/130588256/125217.pdf
    • http://hdtvdude.com/uploads/1/3/0/6/130620483/e55589ec39c68d7.pdf
    • http://dujetul.individ.me/uploads/2020/01/28/wejuvumufipi_pugunejikij_finimafoxosude_pemujemosix.pdf
    • https://narowopipe.weebly.com/uploads/1/3/0/5/130588506/4967855.pdf
    • https://nunalaresuzew.weebly.com/uploads/1/3/0/2/130287504/6d7c258f2d.pdf
    • http://33elmstreet.com/uploads/1/3/0/4/130490056/kixali-mirasofivi.pdf
    • http://richardsonlegalpllc.com/uploads/1/3/0/6/130621663/wibavasowuka_tafuriwog_fixajamavazu_zenewil.pdf
    • http://ki-logistics.com/uploads/1/3/0/5/130551143/degor-soruronigivumig-zerit.pdf
    • http://chinesejerseymoms.com/uploads/1/3/0/4/130483428/lozamadeg-kasadotowo-pivemap.pdf
    • https://gakegobadesumes.weebly.com/uploads/1/3/0/3/130323612/4357381.pdf
    • http://run-myweb.com/uploads/2020/01/28/revagudi.pdf
    • http://room212productions.com/uploads/1/3/0/4/130483902/gaxura.pdf
    • http://zuzonu.audiostart78.icu/uploads/2020/01/29/8a8914.pdf
    • http://nuohotel-zh.devsite-1.com/uploads/1/3/0/2/130270874/130270874.html#how+to+write+a+cv+and+cover+letter+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001636.bin
37b013842090b9fbe0c5515ab0c3e728a49ebccb789a2192b7119cf187bae055		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1636 8832 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.