Malicious PDF — malware analysis report

Static analysis result for SHA-256 ab62689892758141…

MALICIOUS

PDF

36.4 KB Authoring application: OpenOffice Draw
MD5: 531882d915aa18c4d461b90e3f9bca73 SHA-1: c58b56633da78c60be72f3b76e34cab2673185bc SHA-256: ab62689892758141dd9c6ba96275c6366069b0dd4e4ec62a31bcb7fc8a11c962
120 Risk Score

Malware Insights

MITRE ATT&CK
T1204.001 User Execution: Malicious Link T1566.002 Phishing: Spearphishing Link

The sample is a small PDF containing a high volume of external links, triggering the PDF_SEO_LINK_FARM heuristic. The document body contains nonsensical text regarding 'Microcephaly syndrome disease', which is typical of SEO poisoning lures. ClamAV has flagged this as Pdf.Phishing.TtraffRobotInstall, indicating a phishing or traffic-generation campaign.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://goodgirlgonesingle.com/uploads/1/3/0/7/130739182/lodikivo_fowegajit_reravevakib_basatakezerok.pdf
    • http://hotorgrot.net/uploads/1/3/0/5/130546457/pejesajo.pdf
    • http://thebarkwagon.com/uploads/1/3/0/6/130604884/9625247.pdf
    • http://ckfacials.com/uploads/1/3/0/4/130435553/ddb4c6f6f.pdf
    • http://rocathletes.com/uploads/1/3/0/7/130775396/0f6cc81933c5d.pdf
    • http://courageblogs.com/uploads/1/3/0/6/130621068/gubagozubabuku.pdf
    • http://hellayacht.com/uploads/1/3/0/4/130435943/4773057.pdf
    • http://mkbrooks.net/uploads/1/3/0/6/130640144/9cebb5fff0d285.pdf
    • http://enwranch.com/uploads/1/3/0/7/130775825/732326a84c27b6.pdf
    • http://midwestlegalpartners.com/uploads/1/3/0/5/130544063/monewatuwawamogimem.pdf
    • http://andyanddenise.com/uploads/1/3/0/6/130620885/pemaruva-sawenenokopu.pdf
    • http://ijdomesticcommercial.com/uploads/1/3/0/8/130813849/130813849.html#microcephaly+syndrome+disease

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003971.bin
91107de94b82dc21ec453159b89069fe909936bb6aafc4c696956fc25bbc4ad7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3971 7280 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.