Malicious PDF — malware analysis report

Static analysis result for SHA-256 4cf0c89db2892f3e…

MALICIOUS

PDF

36.9 KB Authoring application: OpenOffice.org
MD5: 872a6e9d91cedbed38131484339a1071 SHA-1: a5a7e78d5ddc5609c95e39dc04edcb18532ef28f SHA-256: 4cf0c89db2892f3ec0777f8b906bcb646a41f541e5435ebb8ba1f4fb96f6a601
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 User Execution: Malicious File

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection also flags this as phishing-related. The document body, though heavily corrupted, contains references to these external URLs, suggesting a coordinated effort to redirect users to potentially malicious content. The primary attack pattern appears to be a link farm designed to drive traffic, possibly for SEO manipulation or to host phishing pages.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://fejesumepu.weebly.com/uploads/1/3/0/4/130435925/goligidogazo.pdf
    • http://footbik24.ru/uploads/2020/01/28/8814647.pdf
    • http://paragonhunter.com/uploads/1/3/0/4/130488975/31d599d47.pdf
    • https://napanovesuzoloj.weebly.com/uploads/1/3/0/5/130543035/tarudeviberasar_nedobufuzotazu.pdf
    • http://tere.osteosys.org/uploads/2020/01/29/lukivinaxizawupip.pdf
    • http://joxelobava.dycraft.net/uploads/2020/01/27/dibusoxarububajudix.pdf
    • http://khvalov.info/uploads/2020/01/28/miruborojoji-vesibosemirosaz.pdf
    • http://juletob.myagent.pro/uploads/2020/01/28/7942860.pdf
    • http://rockonradio.info/uploads/1/3/0/5/130588261/gexuvakisorezip.pdf
    • https://retunoroxumolu.weebly.com/uploads/1/3/0/5/130590019/664446.pdf
    • http://premaconsulting.com/uploads/1/3/0/5/130588527/498ece8a2.pdf
    • http://pahasapagrotto.com/uploads/1/3/0/6/130604382/25e43.pdf
    • http://donara.eisk-ads.com/uploads/2020/01/28/8925972.pdf
    • http://wotugaj.sexshop-extra.ru/uploads/2020/01/27/zonedisipujelizox.pdf
    • http://nativeamericanfluteshop.com/uploads/1/3/0/4/130488983/3920133.pdf
    • http://juliejesternewman.com/uploads/1/3/0/6/130605443/130605443.html#ac+to+dc+converter+rectifier+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000013f9.bin
8909350acc8f8254eb5add1380537ac3a7e1bdb684d194344c8977f015e1c371		 pdf-font-stream PDF embedded font (sfnt) at offset 0x13F9 7676 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.