Malicious PDF — malware analysis report

Static analysis result for SHA-256 87c62b8c92bc8a99…

MALICIOUS

PDF

37.1 KB Authoring application: LibreOffice
MD5: 6da8350a79973d559021441a5e2225d8 SHA-1: 29134a877f0e5c9f3b4183280abb13775316a0e7 SHA-256: 87c62b8c92bc8a993d1c2e0348b4f6cb642248b33eca83d71af7399361d0e818
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests a phishing or SEO spam campaign where the document's primary purpose is to redirect users to a multitude of other PDF files hosted on various domains. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports the malicious intent, likely related to traffic generation or phishing.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.deine-va.de/uploads/1/3/0/6/130604741/5914241.pdf
    • http://kentmindfulnesscentre.org/uploads/1/3/0/6/130604505/bc6834469c99cd.pdf
    • http://cicchiservizi.com/uploads/1/3/0/6/130620936/kepogorol.pdf
    • http://ritterassociates.net/uploads/1/3/0/5/130588687/9310606.pdf
    • http://cranecrews.com/uploads/1/3/0/2/130271240/balujatobamat.pdf
    • http://mta-sts.mx.omgp.org/uploads/1/3/0/7/130739375/xugegokipoweju.pdf
    • http://mendozafunez.com/uploads/1/3/0/2/130291591/bamibodafolowiraji.pdf
    • http://spiritofthehorsestables.com/uploads/1/3/0/6/130639116/siwinejugo_rerijofuviwu_lujolusale.pdf
    • http://finbitgroup.org/uploads/1/3/0/5/130589384/5788993.pdf
    • http://triptexts.com/uploads/1/3/0/5/130541597/4eb7e32a5fa.pdf
    • http://abject-adventures.com/uploads/1/3/0/5/130588307/nasinaseverapa-finanopegozi-dewafulolon.pdf
    • http://dietcenter.es/uploads/1/3/0/6/130640028/244c44f.pdf
    • http://jimability.net/uploads/1/3/0/3/130379597/bonevamufam.pdf
    • http://rachelnurmiart.com/uploads/1/3/0/6/130621292/tebipinowa.pdf
    • http://stenhusebolig.dk/uploads/1/3/0/2/130289424/1391472.pdf
    • http://ccevenice.com/uploads/1/3/0/5/130540009/xenoro.pdf
    • http://www.thekingdomsociety.com/uploads/1/3/0/6/130603676/9258a35a0d8451.pdf
    • http://doitmovin.com/uploads/1/3/0/6/130622022/1948191.pdf
    • http://www.mctaggartcapitalllc.com/uploads/1/3/0/7/130775826/jisudi-wixuvuma.pdf
    • http://noahsgiftsandgallery.com/uploads/1/3/0/6/130604715/rolukaguzerud_vinazuzufa_garepop_mezusuxeveriwod.pdf
    • http://cpanel.collegedemsatiu.com/uploads/1/3/0/6/130603676/130603676.html#reading+exercises+grade+5
    • http://spiritofthehorsestables.com/uploads/1/3/0/6/130639116/siwinejugo_rer

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003134.bin
7f8cf075f89c030921b47be2939a58826875dfb33adc2a9d1d429147610d0d0f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3134 8020 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.