PDF malware analysis — malicious · 4ebcae89f4e6ccd8

MALICIOUS

PDF

43.9 KB Authoring application: pdf-parser

MD5: 0a61472f9bd2d3568cda8d31d71c69f2 SHA-1: f794b9c203700860bbe7e987a9158702faf39170 SHA-256: 4ebcae89f4e6ccd83afd0d88e699d7ac7fd7a66a46e5a08efa7c6fd477756784

128 Risk Score

Malware Insights

MITRE ATT&CK

T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The SE_URGENCY_LURE heuristic indicates the document text likely contains language designed to create a false sense of urgency. The ClamAV detection further confirms its malicious nature, classifying it as Pdf.Phishing.TtraffRobotInstall. The primary attack pattern involves directing users to a link farm, likely for phishing or malware distribution.

Heuristics 4

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Urgency / deadline lure low SE_URGENCY_LURE

Document contains urgency or deadline language ('account will be terminated', 'action required within 24 hours', etc.) — useful context, but low-signal without other findings
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://120ebaltimore.com/uploads/1/3/0/7/130738765/309460.pdf
- http://advbiocom.com/uploads/1/3/0/3/130379069/324592.pdf
- http://electjoemartin.com/uploads/1/3/0/4/130492127/2073504.pdf
- http://greenlighttransit.com/uploads/1/3/0/2/130289767/lupivirekuje-mopogopakapawep.pdf
- http://m.transformationlifecoaching.net/uploads/1/3/0/5/130543995/4566b3c618a.pdf
- http://starfishcenter.org/uploads/1/3/0/5/130550708/nubexidodo.pdf
- http://nationalhellenicsociety.net/uploads/1/3/0/6/130604276/5c6122fbc7.pdf
- http://serenityvalley.farm/uploads/1/3/0/7/130775515/wotedawuxunazu.pdf
- http://dredwinkurniawan.com/uploads/1/3/0/7/130775893/rufefudubom.pdf
- http://milwaukeechurches.org/uploads/1/3/0/4/130435646/f908e0873fa3bb.pdf
- http://www.lisakvanhorn.com/uploads/1/3/0/2/130270956/7fdc95dd4e7.pdf
- http://comme-de-liaison.com/uploads/1/3/0/5/130551164/5de7b.pdf
- http://leacentre.com/uploads/1/3/0/7/130776264/4becf66e4f19e7d.pdf
- http://monsieurbidule.com/uploads/1/3/0/2/130288577/59347dd94d9.pdf
- http://sstvipgroup.com/uploads/1/3/0/2/130272890/zasajesoke-pesibudat.pdf
- http://didsburysmiles.com/uploads/1/3/0/5/130590569/xokagedunivifuwidala.pdf
- http://labeach.com/uploads/1/3/0/5/130551684/puguxigax.pdf
- http://teslawirelessenergy.com/uploads/1/3/0/7/130739015/xisikudezuvuxamafuxe.pdf
- http://sweetangelbirdshop.com/uploads/1/3/0/5/130589312/jixasipu.pdf
- http://ishagya.com/uploads/1/3/0/5/130540504/dekeritujuma.pdf
- http://flyyover.com/uploads/1/3/0/6/130639705/gataju.pdf
- http://umsegundoantesdevocemorrer.net/uploads/1/3/0/8/130813531/46293d.pdf
- http://carpetcleancary.com/uploads/1/3/0/2/130272977/zololononagu.pdf
- http://kitchengator.com/uploads/1/3/0/5/130543877/98616d2c6530708.pdf
- http://eye-on-america.com/uploads/1/3/0/2/130288321/dogewuge-rupome-lokis-kobimul.pdf
- http://www.secure-pof.com/uploads/1/3/0/4/130491594/130491594.html#incision+and+drainage+dental+abscess+cpt+code

Extracted artifacts 1

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off0000463e.bin` `2630b90ac61044012da2bed590d0fc333b0462270514624ca3d79641c6ec11d4`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x463E	8440 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.