Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d1daaba21d3c9fb…

MALICIOUS

PDF

42.5 KB Authoring application: pdf-parser
MD5: 52922dc0504370c012d796d765aada73 SHA-1: 4b9b0bb8f51cfe3ee00078e4c1b8e35bb034ee56 SHA-256: 1d1daaba21d3c9fb4b28a5d311f3e5d612c497b5268dd2af01bc3eb72be29aec
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected as malicious by ClamAV with the signature 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. Static analysis revealed a large number of embedded external links, indicative of a link farm designed to redirect users to potentially malicious content. The heuristic 'PDF_SEO_LINK_FARM' specifically flags this behavior, noting 31 generated SEO PDF links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nasr-nabiha.ca/uploads/1/3/0/3/130379798/40abe.pdf
    • http://jack-fruits.com/uploads/1/3/0/3/130323360/gezitala_kuguxov_siwopus.pdf
    • http://sweetlyavas.com/uploads/1/3/0/6/130605162/9449957.pdf
    • http://tamarko.com/uploads/1/3/0/4/130476122/a750577fca3.pdf
    • http://trinkaus.services/uploads/1/3/0/7/130776452/wojomegufiwowufebu.pdf
    • http://dailynutritiontips.com/uploads/1/3/0/4/130483757/dfa456293148a.pdf
    • http://cedarcrestadvisor.com/uploads/1/3/0/4/130478760/xogadujoja_xexuj_pariji_pokulimufa.pdf
    • http://astrologicalinsightsonline.com/uploads/1/3/0/6/130621076/zodibobepujewarosemu.pdf
    • http://reicoinvestment.com/uploads/1/3/0/4/130483540/6738536b.pdf
    • http://tastingfair.ca/uploads/1/3/0/3/130312991/fujake.pdf
    • http://splashyouth.org/uploads/1/3/0/5/130588723/5177c81bf.pdf
    • http://www.bluelorrie.co.za/uploads/1/3/0/7/130739867/befujajetimasige.pdf
    • http://datacenterdan.com/uploads/1/3/0/6/130639307/tafoniz.pdf
    • http://bethwrightdesigns.com/uploads/1/3/0/2/130287221/96bd264878c3.pdf
    • http://somemecosmetics.com/uploads/1/3/0/7/130775257/rikufibo_mamefijaliva_zulegisulizoka.pdf
    • http://gnostichoodoo.com/uploads/1/3/0/4/130476661/luvimovizux.pdf
    • http://www.rootscommunityschool.org/uploads/1/3/0/7/130776667/delidepatibexo_pubisujimogo_gaxonalupan_kugobovu.pdf
    • http://trippyprints.art/uploads/1/3/0/7/130776755/kununasumuzikugej.pdf
    • http://maltabend.k12.mo.us/uploads/1/3/0/6/130603761/9d71b675e.pdf
    • http://haroldcoker.com/uploads/1/3/0/6/130604798/satajatawekok_guluw_kulubov_ralogidugupisi.pdf
    • http://stevehayescreative.com/uploads/1/3/0/7/130739303/84f7eb6.pdf
    • http://jessica-and-jaso-1.rominastiebenphotography.com/uploads/1/3/0/7/130776629/130776629.html#compare+anticoagulants+and+antiplatelets
    • http://tastingfair.ca/uploads/1/3/0/3

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004425.bin
ada0ec8e975b71800c777f4de22ca87c5ac0e7b25c7fa52b102ea829732c917a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4425 8448 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.