Malicious PDF — malware analysis report

Static analysis result for SHA-256 506c8a5784838d62…

MALICIOUS

PDF

36.5 KB Authoring application: LibreOffice Draw
MD5: 63207110cd4ad921be9fc2f0a7322f26 SHA-1: c7449c13b50d609c4473f7beda546379fd74133c SHA-256: 506c8a5784838d6278c422f1c9d4ffba4e0c0c4b74d967c9189ca1fcb7b2f529
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as detected by the PDF_SEO_LINK_FARM heuristic. These links point to PDF files hosted on various domains, suggesting a link farm or redirection scheme. The ClamAV detection also flags this as phishing-related malware. No scripts were extracted from this sample, and the document body content is heavily truncated and unreadable, preventing a more specific analysis of the lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.lushleaflandscapesb.com/uploads/1/3/0/3/130323585/kabimaxaravalegupip.pdf
    • http://lenioffringa.nl/uploads/1/3/0/6/130621507/jasutimi.pdf
    • http://passionistsglasow.com/uploads/1/3/0/3/130313649/e8c68c06e3951.pdf
    • http://partnerwithnat.com/uploads/1/3/0/8/130874583/dorenun.pdf
    • http://onlocation-sh.com/uploads/1/3/0/2/130291453/9761149.pdf
    • http://olumlupsikoloji.com/uploads/1/3/0/7/130775806/1054401.pdf
    • http://reconnecttopurpose.com/uploads/1/3/0/6/130603692/gawagazabikolapa.pdf
    • http://www.allisonsprockfineart.com/uploads/1/3/0/2/130270989/mixuwi-fobadiwumifut-fivosonuvajijib.pdf
    • http://autodiscover.hangarmom.com/uploads/1/3/0/8/130813037/eb9945.pdf
    • http://troop115.com/uploads/1/3/0/4/130490643/928818a2.pdf
    • http://emilydelbridge.com/uploads/1/3/0/5/130538918/3042060.pdf
    • http://marinaspy.com/uploads/1/3/0/5/130546354/6364400.pdf
    • http://mycarpentershop.com/uploads/1/3/0/7/130740191/955b25f2e.pdf
    • http://sbobet.lucky1st.com/uploads/1/3/0/9/130970004/130970004.html#what+causes+extreme+poverty+in+developing+countries

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003623.bin
5cc9272ce1ba7a36f7dd216689d4d96d71119abcbbceb5eefbff02b8e1327e71		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3623 7936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.