Malicious PDF — malware analysis report

Static analysis result for SHA-256 1c890aeab22db9d2…

MALICIOUS

PDF

41.8 KB Authoring application: Inkscape
MD5: 4682439d1774494e7239785fa5dd39a5 SHA-1: 4e7409e8135b179ce1b1807b4ea9c8a55965c562 SHA-256: 1c890aeab22db9d2c2eac81a73a2d19ae7b773989fc0d600d211b618611f0b7f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-driving intent. The document body, though heavily corrupted, contains references to 'Groin tendinopathy treatment' and 'Identity Adobe', suggesting a lure to disguise the malicious link farm.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ravenheim.net/uploads/1/3/0/7/130740265/52596.pdf
    • http://thomasmontero.com/uploads/1/3/0/2/130274338/merejuberipapezax.pdf
    • http://raribuwik.paypal-myaccount.net/uploads/2020/01/28/zatuvevotode_tutiza_xegilomuxape.pdf
    • http://newvisionyouth.org/uploads/1/3/0/6/130621625/fopipafamuv-metobigesekise-tutokedajini-kesomu.pdf
    • http://gabrielledrouin.com/uploads/1/3/0/6/130640084/5284973.pdf
    • https://sogefigelo.weebly.com/uploads/1/3/0/4/130436450/ce2f44e0b6609db.pdf
    • http://talaldaoud.com/uploads/1/3/0/5/130589007/7a3e169.pdf
    • http://beautyparty.co.uk/uploads/1/3/0/5/130550967/jadawuparajo_pegojalu_vumemoxidi.pdf
    • http://southernfertilityandsurgery.com/uploads/1/3/0/6/130639309/fawepabasul.pdf
    • http://stocktalknow.com/uploads/1/3/0/6/130604020/c5b554088a0ad.pdf
    • http://gomriz.com/uploads/1/3/0/7/130775294/130775294.html#groin+tendinopathy+treatment

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000012b2.bin
da86227f9c284d1d80516d70a35621a781e4ad7601c326a6d0f53e5c21c5a194		 pdf-font-stream PDF embedded font (sfnt) at offset 0x12B2 7948 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.