Malicious PDF — malware analysis report

Static analysis result for SHA-256 b475bf6bb1f870cc…

MALICIOUS

PDF

35.2 KB Authoring application: LibreOffice
MD5: 9289f39c1cfc1afa5278c29357d98d15 SHA-1: 31f854e5c293a7da2e3ea3998c727f38bf07a350 SHA-256: b475bf6bb1f870cc6f93317b902932c4357005c8d698715c965fea13a11e5389
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents, a technique often used for SEO manipulation or to host phishing content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.mylegalshieldscam.com/uploads/1/3/0/3/130323707/saditivowowa_benimosameri_ruvosoxulikup.pdf
    • http://americanlifeguards.com/uploads/1/3/0/2/130287553/9c1a4.pdf
    • http://morestyle.com.au/uploads/1/3/0/7/130775878/8279900.pdf
    • http://sbhcoaching.com/uploads/1/3/0/5/130551832/7144963.pdf
    • http://www.officialzero.com/uploads/1/3/0/2/130289521/vibimu.pdf
    • http://mytherapybox.com/uploads/1/3/0/6/130605178/3fb32.pdf
    • http://www.jessbenton.com/uploads/1/3/0/6/130620673/dajemojo.pdf
    • http://minerhosting.at/uploads/1/3/0/6/130604034/08df35f.pdf
    • http://matthewgardlik.net/uploads/1/3/0/2/130289359/4185919.pdf
    • http://airyfitness.com/uploads/1/3/0/6/130639616/zawin.pdf
    • http://steveburketraining.com/uploads/1/3/0/2/130287919/xowurogodido.pdf
    • http://playpokeronlineforrealmoney.com/uploads/1/3/0/6/130639891/5526bc053c38.pdf
    • http://oweddings.net/uploads/1/3/0/2/130289652/fojovuxevogiko_damarawojifep.pdf
    • http://allfortheking.com/uploads/1/3/0/2/130289732/tegunudagexamej_vufesado_jadusavagapa.pdf
    • http://pyrowinery.com/uploads/1/3/0/7/130739094/badesatapevorix-morikegebivades-xajezi-dajinuwivaruluz.pdf
    • http://legalinformatics.net/uploads/1/3/0/3/130379132/62c1c3.pdf
    • http://lamsperspective.com/uploads/1/3/0/7/130775583/kufuziliwani-sezudumodo-worowom-vepal.pdf
    • http://ifeelinfinite.net/uploads/1/3/0/6/130620279/cfed28.pdf
    • http://prbyamandamartinez.com/uploads/1/3/0/8/130874613/3311d1ab6.pdf
    • http://esperanzamassagetherapy.com/uploads/1/3/0/8/130874382/130874382.html#what+type+of+pain+is+postherpetic+neuralgia
    • http://oweddings.net/uploads/1/3/0/2/130289652/f

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d70.bin
9570328b7b41ea88f7d78bd0e6c8cd837c475d809972663c22eb4229270bd8e7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D70 6964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.