Malicious PDF — malware analysis report

Static analysis result for SHA-256 da3de91d983df251…

MALICIOUS

PDF

54.9 KB Authoring application: LibreOffice
MD5: 86b50870eae66b753c7be32907da5ca5 SHA-1: 160f15009fa81a207ea7ce440072f4ac15701dde SHA-256: da3de91d983df2515750ed6406701f4c48db12edcfd6574f80db6696e13d7b49
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to other PDF files hosted on various domains, indicating a link farm or SEO poisoning attempt. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the presence of a visual download button further support a phishing or malicious redirection scheme. The document body content is heavily obfuscated and unreadable, preventing a deeper analysis of its specific lure.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://theperfectsweepdfw.com/uploads/1/3/0/6/130620897/kozopajovilu-kokov-todoba.pdf
    • http://mocomocomilano.com/uploads/1/3/0/2/130270763/4827953.pdf
    • http://artistpaletterestorations.com/uploads/1/3/0/4/130436239/faporusa.pdf
    • http://hometune-up.com/uploads/1/3/0/3/130313102/7052918.pdf
    • http://ilworkforceconnect.com/uploads/1/3/0/7/130775750/30be092cac98.pdf
    • http://simplyexquisitehg.com/uploads/1/3/0/6/130639947/616766.pdf
    • http://randyscottgonzalez.com/uploads/1/3/0/4/130483757/9632298.pdf
    • http://photoandvideoclasses.com/uploads/1/3/0/2/130289480/1605409.pdf
    • http://metropolismville.com/uploads/1/3/0/5/130539269/namowi.pdf
    • http://www.genomindedrx.com/uploads/1/3/0/8/130874111/8993102.pdf
    • http://www.mybackyardfarmla.com/uploads/1/3/0/5/130543155/b47cdc9cb6807dd.pdf
    • http://www.goodfightstudios.com/uploads/1/3/0/6/130604948/2957806.pdf
    • http://crownpairings.com/uploads/1/3/0/5/130540868/5582686.pdf
    • http://www.localmarketinghub.net/uploads/1/3/0/9/130969366/7133973.pdf
    • http://metdonuts.com/uploads/1/3/0/2/130273799/8894287.pdf
    • http://lazera.com/uploads/1/3/0/5/130589433/2894537.pdf
    • http://lajaboneriabodycare.com/uploads/1/3/0/5/130588951/5726761.pdf
    • http://glipsehorizon.com/uploads/1/3/0/6/130639976/sijolaja-doxiset.pdf
    • http://www.austinengravingandsublimation.com/uploads/1/3/0/8/130813991/025a1a22f2e.pdf
    • http://www.gnosventure.com/uploads/1/3/0/5/130551004/7833672.pdf
    • http://webdisk.hrchc.org/uploads/1/3/0/4/130436213/7498024.pdf
    • http://apexsettlementfunding.com/uploads/1/3/0/7/130738591/d78c7.pdf
    • http://cdaniel-opus.com/uploads/1/3/0/8/130874497/354cb0c25f.pdf
    • http://mnbaby590988.org/uploads/1/3/0/6/130603696/003e3f6c0f3.pdf
    • http://houseboat.site/uploads/1/3/0/7/130776553/jedaxade_tiroxilujisa_subilonawujor.pdf
    • http://ereksitahanlama.com/uploads/1/3/0/8/130813646/130813646.html#corporate+accounting+notes+in+hindi+pdf
    • http://artistpaletterestoratio

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003c14.bin
da097a8c459adbfdf1b1d97412e41569b305acf822c6e113ff3e46e38a168572		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3C14 16224 bytes
font_01_sfnt_off000050eb.bin
236d54f3e2479d5e72da3d1be4616617e509581c3e9108e812f40a19f40d28ff		 pdf-font-stream PDF embedded font (sfnt) at offset 0x50EB 2228 bytes
font_02_sfnt_off00005ae9.bin
cfcada7814bf1f456567b6915b4670dd9ab956365655945d8dd2c81ff9b2c964		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5AE9 7560 bytes
font_03_sfnt_off0000714c.bin
c705dcf1a20223c4015a2017621b0277c696194e83018d8ca2ac0eb9b17c346b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x714C 8284 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.