Malicious PDF — malware analysis report

Static analysis result for SHA-256 1ab7b3c942913bf8…

MALICIOUS

PDF

37.6 KB Authoring application: Solid Converter PDF
MD5: 4492727b13077334efe5414d76fa196a SHA-1: ef9b874b6bf642f956e8d7dd0b21749fcb6776ad SHA-256: 1ab7b3c942913bf8fa9beab7bfc632ec47d5aa1ef15fc9172a9255d491296085
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links pointing to external PDF files hosted on various domains. This technique is commonly used for SEO-based phishing or to distribute malware by overwhelming search engine indexes with seemingly legitimate content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and traffic redirection nature of this file.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mylebleutriad.com/uploads/1/3/0/5/130539329/zixumedeta-nosopusif.pdf
    • http://aisthetik.com/uploads/1/3/0/3/130379231/4300eb6ad.pdf
    • http://glowbearcare.com/uploads/1/3/0/6/130604024/fd322971d20e93.pdf
    • http://magdasita.studio/uploads/1/3/0/6/130604732/vivipopizaguxaw.pdf
    • http://www.yoga.transformationplayground.com/uploads/1/3/0/3/130313186/sakemenamalor.pdf
    • http://sonoratradingpost.net/uploads/1/3/0/7/130774981/defuvageded.pdf
    • http://gelinkalbigelinlik.com/uploads/1/3/0/7/130739654/5352524.pdf
    • http://rimmermusicgroup.com/uploads/1/3/0/9/130969937/nitufejar.pdf
    • http://gcsurveryors.designpreviewer.com/uploads/1/3/0/5/130542971/49cf379fad.pdf
    • http://tasteofwater.org/uploads/1/3/0/3/130379098/df008.pdf
    • http://arbrew.com/uploads/1/3/0/7/130739773/d782e83e3d.pdf
    • http://nolanthomascoffey.com/uploads/1/3/0/3/130379462/101c09f5260.pdf
    • http://www.zetaestates.com/uploads/1/3/0/5/130589047/juvafetuto.pdf
    • http://www.daisykrikun.com/uploads/1/3/0/7/130776850/c4cbcc.pdf
    • http://jongrahamphoto.com/uploads/1/3/0/5/130543656/lujowovuzulubi_vuvokoxuvoxanil_zuruz.pdf
    • http://happylion.live/uploads/1/3/0/6/130621218/1599703.pdf
    • http://rnconnectonline.com/uploads/1/3/0/7/130775431/lirod.pdf
    • http://mta-sts.caberlight.net/uploads/1/3/0/7/130775220/libegedixe-lixopadixu-kozewukajulikik-donipesol.pdf
    • http://windowfarms.info/uploads/1/3/0/5/130551656/siwopigakawow.pdf
    • http://shaunabettencourt.com/uploads/1/3/0/3/130313343/3b20db85a434b8.pdf
    • http://churchstrettontaxi.com/uploads/1/3/0/6/130620756/130620756.html#sample+of+simple+resignation+letter+due+to+personal+reasons
    • http://magdasita

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000034af.bin
6490e5a89ad7623e39f7b78c7bb233d38c5d76e50c07447e612d90e3fd689d44		 pdf-font-stream PDF embedded font (sfnt) at offset 0x34AF 7496 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.