Malicious PDF — malware analysis report

Static analysis result for SHA-256 1b77afd053248fec…

MALICIOUS

PDF

44.4 KB Authoring application: PDFedit
MD5: 68d41066c943c8c62676f4abd9a18beb SHA-1: cf7356be25916574572afb031e7b8a9bdceca961 SHA-256: 1b77afd053248fecd5041bbf7370d29920c164741234db61185a6a05d7a1759f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF documents. This behavior is indicative of a link farm, often used for SEO manipulation or to distribute phishing content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious traffic generation intent. No scripts were extracted, and the document body was heavily truncated and unreadable.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://robertodesignhouse.com/uploads/1/3/0/7/130775627/sakibowupunozi-mubogadazazu.pdf
    • http://richmond-math.com/uploads/1/3/0/5/130539691/burid.pdf
    • http://ourshowlive.com/uploads/1/3/0/6/130620366/zaguj.pdf
    • http://www.1and1forex.com/uploads/1/3/0/6/130621969/b40f130.pdf
    • http://jalensowell.com/uploads/1/3/0/7/130739933/7252178.pdf
    • http://hydeconsulting.co/uploads/1/3/0/7/130775174/fakamujawixo_lagagag.pdf
    • http://1001emotions.com/uploads/1/3/0/5/130552034/dcdcbf7ed.pdf
    • http://natashafine.com/uploads/1/3/0/6/130620651/979649.pdf
    • http://northeasterndistrict.com/uploads/1/3/0/5/130538902/sugewekorevo.pdf
    • http://www.blog.adamcares.com/uploads/1/3/0/4/130476456/7057615.pdf
    • http://mail.nathannegri.com/uploads/1/3/0/6/130640061/6511566.pdf
    • http://www.tricolorprint.com/uploads/1/3/0/8/130874129/vafox.pdf
    • http://ankezimmermann.ca/uploads/1/3/0/2/130271117/130271117.html#severe+lower+back+pain+in+2nd+trimester

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003dcd.bin
65ca2fa633a49bc637c245e3469a24bec82cbb291b9200d770c42ee2df1588ac		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3DCD 16096 bytes
font_01_sfnt_off00005568.bin
c3744461414b4b6fb9fbfa7ae5e50c2a3d4d0a368b5464a94e28ca21d110d12a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5568 8184 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.