Malicious PDF — malware analysis report

Static analysis result for SHA-256 f8ca381b0081f3be…

MALICIOUS

PDF

51.1 KB Authoring application: LibreOffice
MD5: 6503ed88e556869f74fcff8c8d2694e7 SHA-1: 6a859c996dc52aa71b9c66d497500e01d2252fe0 SHA-256: f8ca381b0081f3be1d79b5fd5699d629200450d50e69012e8ff8a7c09758be05
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to other PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV heuristic also identified this as Pdf.Phishing.TtraffRobotInstall, indicating a phishing or malicious distribution intent. No scripts were extracted, but the sheer volume of external links suggests a coordinated effort to redirect users.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://myinklady.com/uploads/1/3/0/2/130288864/nudux.pdf
    • http://www.marcoantoniopatrizio.com/uploads/1/3/0/4/130492315/suwogod.pdf
    • http://frontline-spray.com/uploads/1/3/0/3/130324112/nitonotex.pdf
    • http://mta-sts.mail2.vanbenthem-advies.nl/uploads/1/3/0/3/130379183/79058cdcb4b6.pdf
    • http://boneandjointdocs.com/uploads/1/3/0/6/130604518/44361.pdf
    • http://muninbikes.com/uploads/1/3/0/3/130313339/56fb0b1469ad.pdf
    • http://mountainmodelaires.org/uploads/1/3/0/7/130776745/328a1212667c96.pdf
    • http://alephiconsulting.com/uploads/1/3/0/6/130639995/c14b65bd.pdf
    • http://mexicocityshuttle.com/uploads/1/3/0/4/130476004/nepajavizapavos-gunosa.pdf
    • http://www.papershellanalytics.com/uploads/1/3/0/3/130379803/6d2f061d46ba.pdf
    • http://efmlufkintx.org/uploads/1/3/0/5/130551330/8a1907.pdf
    • http://charliedelta.net/uploads/1/3/0/6/130620986/adb510c2e16e9.pdf
    • http://mariana-test.devsite-1.com/uploads/1/3/0/4/130436166/xesotumupaxifeto.pdf
    • http://ageinmyplace.net/uploads/1/3/0/8/130873894/jarawukagazinenoleg.pdf
    • http://wifeycosmetics.com/uploads/1/3/0/5/130540009/mubavexijawudatil.pdf
    • http://kittenconvict.com/uploads/1/3/0/4/130489742/dijikaxamuziwiz.pdf
    • http://gbcareers.org/uploads/1/3/0/7/130738875/99d3937.pdf
    • http://karissatse.com/uploads/1/3/0/7/130740351/wepatifasutina.pdf
    • http://rinehartpiano.com/uploads/1/3/0/8/130814250/8b8f1.pdf
    • http://www.rusnam.com/uploads/1/3/0/5/130551534/9075721.pdf
    • http://wendysglorybox.com/uploads/1/3/0/4/130488382/numuruvuxidubepube.pdf
    • http://viviantung.com/uploads/1/3/0/6/130620416/2619244.pdf
    • http://penguinjournal.tech/uploads/1/3/0/7/130739662/lawagonivib_neruwodafug_mesaverixab.pdf
    • http://centreelmos.com/uploads/1/3/0/5/130588681/reramabisivuj.pdf
    • http://74-123-76-231.mgwnet.com/uploads/1/3/0/9/130969989/130969989.html#ethnographic+approach+to+qualitative+research

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001104.bin
76ebd2eb76d344c3d8f0501f9ad016b685b5b176147a015dcc3ca2c328c49f56		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1104 8616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.