Malicious PDF — malware analysis report

Static analysis result for SHA-256 ce87926844cba51a…

MALICIOUS

PDF

32.3 KB Authoring application: LibreOffice Draw
MD5: 4d9fd22dafdd41d95d7d700806c03814 SHA-1: 16ce3e3a48608a2467ada5a04496c1242b2f0314 SHA-256: ce87926844cba51aef45b2a67aba9d421de4701faa2d737680b8d4e190f8b95a
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. This indicates a likely attempt to direct users to a network of potentially malicious websites, as also suggested by the ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. The document body is heavily obfuscated and does not provide clear user-facing content, but the presence of a 'SE_DOWNLOAD_BUTTON' heuristic suggests a lure for user interaction. The primary attack pattern involves leveraging these links for phishing or malware delivery.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://price-loto.site/uploads/1/3/0/6/130605216/5470759.pdf
    • http://my3girls.blog/uploads/1/3/0/2/130287284/jikow-topezux-malubozibavewij.pdf
    • http://dianehulsejewelry.com/uploads/1/3/0/2/130270813/a6bd465e0480018.pdf
    • http://bearvbaby.org/uploads/1/3/0/5/130540645/046d2ef8.pdf
    • http://karenjanewalker.net/uploads/1/3/0/3/130379514/majetam_magenefadu_vigaxobinelex_gofevi.pdf
    • http://zenithenergylimited.com.au/uploads/1/3/0/7/130739658/wubor.pdf
    • http://mohammadshehataactor.com/uploads/1/3/0/2/130287852/6674741.pdf
    • http://newteam5000.com/uploads/1/3/0/7/130776585/4799572.pdf
    • http://reputablebusiness.net/uploads/1/3/0/5/130551449/9964392.pdf
    • http://buywonderfulpot.com/uploads/1/3/0/6/130603969/05f7ed8992.pdf
    • http://khalilmamoon.net/uploads/1/3/0/8/130814459/marevovopuvamu-xosoki-bokuk-vubazezekaxap.pdf
    • http://readyforretirement.net/uploads/1/3/0/4/130476574/ee2bf96.pdf
    • http://starboardopportunitypartners.com/uploads/1/3/0/6/130604523/8499301.pdf
    • http://norwichladsabc.co.uk/uploads/1/3/0/4/130435813/malalajujili.pdf
    • http://luckyleafcannabis.com/uploads/1/3/0/7/130776476/kewomigikegusidanu.pdf
    • http://4us2wire.com/uploads/1/3/0/7/130738859/5922688.pdf
    • http://neckiesbymj.com/uploads/1/3/0/5/130589218/1539336.pdf
    • http://thelearnnplayhouse.com/uploads/1/3/0/6/130603828/sadozogofela.pdf
    • http://softcom.live/uploads/1/3/0/5/130551925/warirexazot_nujeju_wugativiri.pdf
    • http://74-123-78-173.mgwnet.com/uploads/1/3/0/7/130776889/130776889.html#airtel+dth+helpline+ahmedabad

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001ef3.bin
80558af415f3b217466c9b894863facd92d159b9cf762b6057a84a761c004fa3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1EF3 7876 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.