Malicious PDF — malware analysis report

Static analysis result for SHA-256 e1c1a03274faf052…

MALICIOUS

PDF

38.4 KB Authoring application: LibreOffice Draw
MD5: 6ed96436ad25383349c09cf6b5f5ec2e SHA-1: 2c919597d5ff3e3bb9191cf26a295c11e12c20bb SHA-256: e1c1a03274faf0524f4bae2c348b5c257dc496356903f046ad6900fe5820cbe0
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, each hosting a PDF file with a numeric or book-related slug in its path. This pattern strongly suggests a link farm or SEO manipulation tactic, potentially used to drive traffic or distribute malicious content. The ClamAV detection further confirms its malicious nature, classifying it as Pdf.Phishing.TtraffRobotInstall.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://gobeyondthepond.com/uploads/1/3/0/2/130272234/6579490.pdf
    • http://www.bladebooking.ca/uploads/1/3/0/6/130604935/840925da272f.pdf
    • http://movingforwardtogethertoday.com/uploads/1/3/0/2/130288514/e18aa21d565218a.pdf
    • http://dhillon-s-ltd.com/uploads/1/3/0/7/130739371/cb255b3cb4bc.pdf
    • http://waconda.com/uploads/1/3/0/6/130604311/joluzogoledunakezi.pdf
    • http://www.bulldogrestorationservices.org/uploads/1/3/0/6/130621744/tewojobewu-darefogar-lizirexuwurawim.pdf
    • http://oasismethod.com/uploads/1/3/0/2/130274282/bativuxufi.pdf
    • http://joinsapd.com/uploads/1/3/0/2/130289385/87c637.pdf
    • http://padeljobs.org/uploads/1/3/0/5/130544313/juwudiget_karenejejepenok_tozofi_nirisubizosixo.pdf
    • http://supersecretprojectx.com/uploads/1/3/0/8/130874615/2588136.pdf
    • http://simoncdrew.com/uploads/1/3/0/5/130550961/mudavovivebosik_pinitonomej_ditibix.pdf
    • http://tessandpaul.com/uploads/1/3/0/8/130874246/09ad7562a59.pdf
    • http://forthequail.com/uploads/1/3/0/2/130270746/979cb650c95c58.pdf
    • http://drmsanchez.com/uploads/1/3/0/7/130775211/cdfacd.pdf
    • http://danielrudin.com/uploads/1/3/0/7/130776763/728c425ee4c89.pdf
    • http://beautifulhabits.net/uploads/1/3/0/5/130588740/tibog.pdf
    • http://www.businesscopywriter.net/uploads/1/3/0/4/130488199/60ec1489e6.pdf
    • http://bacroads.com/uploads/1/3/0/6/130620614/b2d9cd970eea.pdf
    • http://microsoftpost.net/uploads/1/3/0/6/130639659/fefcd07d23f28.pdf
    • http://nastockdogassociation.com/uploads/1/3/0/5/130542953/a87df0.pdf
    • http://experiencelovebermuda.com/uploads/1/3/0/7/130739437/guxefobegapatijapupo.pdf
    • http://cementfab.com/uploads/1/3/0/6/130605501/4945659.pdf
    • http://mail.bbsimon.com/uploads/1/3/0/2/130274032/xazozavorizez_kufedidivewo.pdf
    • http://szml.brdge.org/uploads/1/3/0/4/130476307/130476307.html#math+worksheets+for+2nd+grade+pdf
    • http://www.bulldogrestorationservices.org/uploads/1/3/0/6/130621744/tewojobewu-darefogar-liz

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000035a7.bin
efbdd54d866fede128e9aa97aeac09693bcb342fa0bf746c400dcc50273c6cde		 pdf-font-stream PDF embedded font (sfnt) at offset 0x35A7 7188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.