Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e5fc8989ab7b62d…

MALICIOUS

PDF

37.3 KB Authoring application: LibreOffice
MD5: 7f5ad50b474fac2d13c468702b9cb81f SHA-1: a2ea8bd0f34fa082af2d11d1912136614850b550 SHA-256: 8e5fc8989ab7b62db39b75db48ff1689a2bdab9109c5b5db92a03d058f33575a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a link farm or redirection scheme. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent, likely related to phishing or traffic generation. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sbhcoaching.com/uploads/1/3/0/5/130590545/4395647.pdf
    • http://matthewodempsey.com/uploads/1/3/0/6/130639885/8275350.pdf
    • http://victorialartey.com/uploads/1/3/0/4/130488338/befuwapewusux.pdf
    • http://bengalpoker.com/uploads/1/3/0/5/130551728/446583e5.pdf
    • http://mystayathomejob.com/uploads/1/3/0/6/130639419/fatugaxagipiziz.pdf
    • http://lucassincasa.com/uploads/1/3/0/6/130620926/5109282.pdf
    • http://lxis.org/uploads/1/3/0/5/130550787/xibutob-getavob.pdf
    • http://danamarvel.com/uploads/1/3/0/5/130541950/7361709.pdf
    • http://www.westshoreland.org/uploads/1/3/0/8/130813785/2c4ff02ba.pdf
    • http://carlosdevilanova.com/uploads/1/3/0/5/130588987/xopulizamuwata-teronafezubap-lotuzivimut-wodofazanijiw.pdf
    • http://pusayorkunited.net/uploads/1/3/0/7/130775337/fimudewusoxav_rumokodobakole.pdf
    • http://mixlegacy.com/uploads/1/3/0/6/130621458/pezaxi.pdf
    • http://hostmaster.therecoveryfestival.co.uk/uploads/1/3/0/7/130738578/xifapot.pdf
    • http://ucmen.com/uploads/1/3/0/6/130621290/fbdbf616.pdf
    • http://pwcss.net/uploads/1/3/0/7/130775106/vanozodevewelo_virijexalibo_vawurowozota_rixamodedira.pdf
    • http://helpgarret.life/uploads/1/3/0/7/130739185/6344962.pdf
    • http://michelleblanchette.org/uploads/1/3/0/4/130488743/fuxigedi.pdf
    • http://www.robinbladimir.org/uploads/1/3/0/7/130739474/xavegesovaze.pdf
    • http://easyaffiliaterevenue.com/uploads/1/3/0/6/130620579/2318426.pdf
    • http://bitcoinserv.co.uk/uploads/1/3/0/6/130622042/limenovog-nadizojokabi-reguvewepo.pdf
    • http://southernbredpups.com/uploads/1/3/0/8/130874329/fegutuj.pdf
    • http://444.bpmtc.com/uploads/1/3/0/2/130270813/130270813.html#science+project+abstract+examples
    • http://southernbredpups.com/uploads

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003219.bin
14f001cd1e98050ab95e125265b76a5f82e43c7a6a946a3c8d2fe604d943d8c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3219 7640 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.