Malicious PDF — malware analysis report

Static analysis result for SHA-256 cbafb5093606c26e…

MALICIOUS

PDF

34.3 KB Authoring application: LibreOffice Draw
MD5: 3ecf2648cff122c68fed956a4e34f306 SHA-1: 029bc5586dbbc8fc9a87e6a3b012acd2f79f985b SHA-256: cbafb5093606c26ef19442f07ea0c67ff21c85db9d76766a27ab384b06523ecd
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDF files, a technique often used for SEO manipulation or to host phishing lures. ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious download intent. The heuristic 'PDF_SEO_LINK_FARM' directly indicates the presence of numerous external links, with 'motta-ddd.pl' being a dominant host. The document body is heavily obfuscated and does not provide further insight into the specific lure.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://motta-ddd.pl/uploads/1/3/0/5/130545666/baef20b03096.pdf
    • http://mypostbargain.com/uploads/1/3/0/2/130289214/pujedunokezobu.pdf
    • http://triosreadydentallaboratories.com/uploads/1/3/0/3/130313015/mukiwage_pugerixabeba_lipowagowuzig_fujajufomefe.pdf
    • http://casualkids.net/uploads/1/3/0/7/130775949/3a5efa2465f7.pdf
    • http://e-performancetahiti.com/uploads/1/3/0/6/130639099/373dcb76b3.pdf
    • http://northstarholistic.com/uploads/1/3/0/2/130270924/b416d72008fc.pdf
    • http://webmail.thesinglespoon.com/uploads/1/3/0/7/130775979/xakikiwanime-dafozon-tepamerikezed-fotigada.pdf
    • http://peercard.net/uploads/1/3/0/3/130323896/timaxowopekepisakip.pdf
    • http://virtuallynotarized.com/uploads/1/3/0/3/130323962/7380359.pdf
    • http://educazionelibertaria.com/uploads/1/3/0/4/130435594/tutimililimiwiviva.pdf
    • http://mbrsmartbook.com/uploads/1/3/0/5/130589218/pogisowoxafis.pdf
    • http://blackoutpoems.com/uploads/1/3/0/6/130603698/a268684418d82ce.pdf
    • http://hcanalesrojas.com/uploads/1/3/0/5/130551526/karekejula.pdf
    • http://engineeringally.com/uploads/1/3/0/4/130483350/voravukorigiwuw.pdf
    • http://www.successbydesignliteracy.com/uploads/1/3/0/5/130551019/1622619.pdf
    • http://rhinobullybook.com/uploads/1/3/0/6/130639294/sadisixurokado.pdf
    • http://assuredwildlifecontrol.com/uploads/1/3/0/7/130739719/mejufuwesidut_takaraweku.pdf
    • http://camporiondo.com/uploads/1/3/0/5/130543740/dalazijewozugig.pdf
    • http://universeoftoronto.com/uploads/1/3/0/2/130289745/1395406.pdf
    • http://noboysbeauty.com/uploads/1/3/0/2/130289344/bigulirunoxir.pdf
    • http://humannaturefoundation.com/uploads/1/3/0/5/130545932/130545932.html#adobe+acrobat+pro+dc+flatten+script

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000026d3.bin
fa7be45a3e8dc1425b01163059b670bc04792230b5ecbcccf9cc3385751c2adf		 pdf-font-stream PDF embedded font (sfnt) at offset 0x26D3 7636 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.