Malicious PDF — malware analysis report

Static analysis result for SHA-256 e58cc261586d0995…

MALICIOUS

PDF

42.0 KB Authoring application: LibreOffice Draw
MD5: bb63ebd5bcbc1062365bca0136487627 SHA-1: 3cc05f4c01449627f53482a2d6984f048465c1f5 SHA-256: e58cc261586d0995c95b3b3689f24e8229d9b9c6897b570432927f975b732058
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDFs, a technique commonly used for SEO poisoning and directing users to malicious sites. ClamAV also detected this file as 'Pdf.Phishing.TtraffRobotInstall-7605656-0', indicating a phishing or traffic redirection purpose. The presence of a 'download button' heuristic further supports the lure-based attack pattern.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://southerncharmgetaways.com/uploads/1/3/0/3/130323412/512966cf0211c0f.pdf
    • http://jminguet.com/uploads/1/3/0/6/130620865/pinufebun_gokamefonobi.pdf
    • http://newaplusenvironmentalrestoration.com/uploads/1/3/0/4/130489241/4468572.pdf
    • http://mobileopsdetailing.com/uploads/1/3/0/6/130604940/kexekobose-rojenavisapawi-dafuzul.pdf
    • http://notaiobrunzo.it/uploads/1/3/0/6/130605393/vojajowelan.pdf
    • http://phillbriscoe.net/uploads/1/3/0/3/130323328/5fe190.pdf
    • http://cresslandbythesplash.com/uploads/1/3/0/7/130776656/wedinanufab.pdf
    • http://maralynhargrove.com/uploads/1/3/0/6/130603936/5007943.pdf
    • http://satellitesessionsmusic.com.au/uploads/1/3/0/6/130621509/e4d4e6ecd08.pdf
    • http://nomadiccollege.com/uploads/1/3/0/6/130604294/noniteregezede.pdf
    • http://musicofpraises.com/uploads/1/3/0/4/130483153/5881674.pdf
    • http://cherylberyl.com/uploads/1/3/0/6/130640235/1710546.pdf
    • http://nanasglitter.com/uploads/1/3/0/7/130738847/a3b730abf6.pdf
    • http://davidmwilliams.info/uploads/1/3/0/7/130775387/9323088.pdf
    • http://northernlightspace.com/uploads/1/3/0/4/130483902/kigol.pdf
    • http://emoryinc.com/uploads/1/3/0/6/130620603/zakiv.pdf
    • http://simplychrischan.com/uploads/1/3/0/7/130739039/cd8561338.pdf
    • http://mrsuttonhistory.com/uploads/1/3/0/5/130547969/gajiturig_senuwumubixi.pdf
    • http://bajasharkdiving.com/uploads/1/3/0/5/130550944/kogojutatuzixezulomu.pdf
    • http://trixiekitty.com/uploads/1/3/0/3/130323437/42243556d6f051.pdf
    • http://nbptweddingplanner.com/uploads/1/3/0/6/130605442/043bca91155a4f7.pdf
    • http://africanubuntusafaris.com/uploads/1/3/0/7/130739369/1068134.pdf
    • http://kevinpistole.com/uploads/1/3/0/5/130551063/fasorujeba-ditixotixesi.pdf
    • http://jewels-hair-studio.com/uploads/1/3/0/4/130476462/130476462.html#gta+san+andreas+cheats+pc+download+free+game
    • http://phillbriscoe

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003f3e.bin
3216e346acbdd61ca2f1dc92e91435295681d66550127544c49c1801744f3227		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3F3E 8908 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.