Malicious PDF — malware analysis report

Static analysis result for SHA-256 1a7c3d7e1acd7270…

MALICIOUS

PDF

41.8 KB Authoring application: QPDF
MD5: 79749790f066dbf1d651ef7e8db584c4 SHA-1: 7408f0f898a9d66257d6bd22274911462681befc SHA-256: 1a7c3d7e1acd72709ba904f0b55566750f236e587ab541ced90624643dabbc30
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs, identified by the PDF_SEO_LINK_FARM heuristic. These URLs point to various domains, suggesting a link farm or a distribution point for malicious content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or traffic redirection intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://naturalchildbirthhelena.com/uploads/1/3/0/8/130814457/4848171.pdf
    • http://randysapp.net/uploads/1/3/0/5/130550931/8943172.pdf
    • http://umotivemove.com/uploads/1/3/0/3/130313368/zixutafala.pdf
    • http://babiesdontcry.space/uploads/1/3/0/3/130323568/rilarenew.pdf
    • http://visualtrad.com/uploads/1/3/0/2/130272921/sazugojafigu.pdf
    • http://myprovidenceconstruction.com/uploads/1/3/0/3/130379415/guwawijej_sagamezemewiw_radaza.pdf
    • http://uteo.us/uploads/1/3/0/4/130476454/xekezibax.pdf
    • http://cannabiscompounder.shop/uploads/1/3/0/7/130740561/zozukekat_nosafet.pdf
    • http://fassfoods.com/uploads/1/3/0/7/130739483/9e1b88.pdf
    • http://mylaraonline.com/uploads/1/3/0/4/130483520/lezadodanasog.pdf
    • http://jmhudsonconsulting.com/uploads/1/3/0/8/130813609/2703927.pdf
    • http://kotbabos.site/uploads/1/3/0/7/130739750/12a3ade8a2.pdf
    • http://becomeless.com/uploads/1/3/0/5/130543552/f5b069cb5402e.pdf
    • http://gaybabydiaperhangout.com/uploads/1/3/0/6/130620456/sejujotum-vopadidaj-vekov.pdf
    • http://djspryte.com/uploads/1/3/0/6/130621574/4692389.pdf
    • http://moviebuffet.net/uploads/1/3/0/7/130775156/2719132.pdf
    • http://tipasians.com/uploads/1/3/0/7/130738841/wapadiki_sobekerurozij.pdf
    • http://nangrayphotography.com/uploads/1/3/0/7/130740082/7a2db2.pdf
    • http://stanleyconstruction.org/uploads/1/3/0/2/130287992/2325986.pdf
    • http://creamspot.com/uploads/1/3/0/6/130639573/burozex.pdf
    • http://rct2f6.bdgct.com/uploads/1/3/0/4/130435842/130435842.html#sindrome+di+anticorpi+antifosfolipidi+sintomi

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000436f.bin
2329e6ec71e79f434b2f19803120a136991435b386de20e0ffd6cc42f79f7da2		 pdf-font-stream PDF embedded font (sfnt) at offset 0x436F 8836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.