Malicious PDF — malware analysis report

Static analysis result for SHA-256 4e7eee4c6c72e080…

MALICIOUS

PDF

120.4 KB Authoring application: OpenOffice.org
MD5: 4bd4c695dca483c54be11a1c6168b9dc SHA-1: 8d84b6ffb951270a0c25bb54d96331efcb2497ef SHA-256: 4e7eee4c6c72e080c093c87911d3c08631aee8f7ae27cdd9c8e523ac483e187d
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or distribution mechanism. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious intent, likely related to phishing or traffic redirection. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://accountinghoustontexas.com/uploads/1/3/0/7/130740149/46ac9318da76.pdf
    • http://maseraticonnection.com/uploads/1/3/0/4/130435892/7c2aee6f887833b.pdf
    • http://noxanima.com/uploads/1/3/0/3/130323329/mosaf.pdf
    • http://briannajahn.com/uploads/1/3/0/3/130323822/zurapofetodejagepere.pdf
    • http://facefeats.com/uploads/1/3/0/3/130313783/gemowejozab.pdf
    • http://babybirthcharts.com/uploads/1/3/0/2/130289229/kedesegokowebovu.pdf
    • http://resurfacetechnology.com/uploads/1/3/0/2/130272233/nedomuze_lofigevidapom.pdf
    • http://minnesotahistorymuseums.org/uploads/1/3/0/3/130313057/c95428.pdf
    • http://zoombuyz.com/uploads/1/3/0/3/130379096/vazoliv.pdf
    • http://acupunturavetbarcelona.com/uploads/1/3/0/7/130776612/f1113e65.pdf
    • http://trianglewriting.com/uploads/1/3/0/9/130969472/gasetufisoxaxilewu.pdf
    • http://www.playfulearning.net/uploads/1/3/0/6/130605194/3514406.pdf
    • http://agisti.com/uploads/1/3/0/4/130436007/xuzarodomut_wapab.pdf
    • http://peereditingandreview.com/uploads/1/3/0/7/130776811/feloxeluw-bumavatug-letibofiwajol.pdf
    • http://www.mjartwork.com/uploads/1/3/0/3/130379251/f8d17c897d5f54.pdf
    • http://4t51w5.salon225.com/uploads/1/3/0/2/130291800/130291800.html#crosby%C2%AE+pressure+relief+valve+engineering+handbook

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000069ee.bin
ffa661c64f942d0bcfa7b83a7dba3ccdc7a061669e540ab202b925fc28c4dc07		 pdf-font-stream PDF embedded font (sfnt) at offset 0x69EE 8872 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.