Malicious PDF — malware analysis report

Static analysis result for SHA-256 1d9e21eb4234cca5…

MALICIOUS

PDF

46.8 KB Authoring application: Adobe PDF Library 9.0
MD5: 948b1ca4dbf8a7760bc232376fa0d121 SHA-1: 49626f970489a1a17237bf74368aea0f94d897cf SHA-256: 1d9e21eb4234cca583149e8f73c129221d27098261669fbcbe4d5036cade6cab
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links pointing to external PDF files. This behavior is indicative of a link farm or SEO manipulation tactic, as flagged by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection further supports its malicious nature. No scripts were extracted, and the document body was heavily obfuscated, making it difficult to determine a more specific attack pattern beyond the link distribution.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.heywildflower.com/uploads/1/3/0/9/130969030/8c8cf.pdf
    • http://durhamyouthprograms.org/uploads/1/3/0/6/130639220/3826312.pdf
    • http://seacoastconsultingllc.com/uploads/1/3/0/6/130620321/1757cb8.pdf
    • http://sharkdinghy.com/uploads/1/3/0/6/130605396/1879912.pdf
    • http://rapidrefillsantacruz.com/uploads/1/3/0/7/130775391/tirunovofowimib_lurimodozuzur_jewidolalebewar.pdf
    • http://mangaandanime.net/uploads/1/3/0/6/130604729/1452997.pdf
    • http://00964.net/uploads/1/3/0/5/130538996/pubus.pdf
    • http://mrsscunningham.com/uploads/1/3/0/4/130491008/2370743.pdf
    • http://lynettebear.com/uploads/1/3/0/6/130621780/widoropasikusov_dozanadegiwewaf_vopibarezusulog.pdf
    • http://feltygolf.com/uploads/1/3/0/5/130543941/nilamukozusepa-winisares-duxoposiv-dagidoxuloxovo.pdf
    • http://boshuster.com/uploads/1/3/0/4/130488500/e7e028d.pdf
    • http://discountrocketlaunchers.com/uploads/1/3/0/6/130605107/b5dd74f.pdf
    • http://orlandoaccidentlawyer.net/uploads/1/3/0/5/130551073/7798092.pdf
    • http://104450345337014885.com/uploads/1/3/0/3/130313272/c020736fa0.pdf
    • http://www.kdechallenge.org/uploads/1/3/0/6/130604014/robagojake-natonogutam-gawofopinuk-dozesodezumep.pdf
    • http://djmir.net/uploads/1/3/0/6/130604785/bojosazonup_buzinolo_jaxefo.pdf
    • http://panamacitybeachsurf.com/uploads/1/3/0/6/130639071/114684d83ecfc16.pdf
    • http://motercontrol.com/uploads/1/3/0/5/130550803/434794.pdf
    • http://hollomantdycrashpad.com/uploads/1/3/0/2/130287278/fovijorili_durevimefu_lifuwesevaxujiv.pdf
    • http://fashiontrendingstyles.com/uploads/1/3/0/7/130776349/8063451.pdf
    • http://sisstar289.com/uploads/1/3/0/3/130313271/8792002.pdf
    • http://rac-ng.com/uploads/1/3/0/2/130288729/pigosaza_nelex_zadatu.pdf
    • http://mta-sts.accminlao.com/uploads/1/3/0/6/130605048/daripu.pdf
    • http://rxtraining.ca/uploads/1/3/0/6/130639873/nipurijoge-favux-tikanejupav-lileleja.pdf
    • http://thebradfordwatch.com/uploads/1/3/0/6/130639842/lawitibuz-desesilakav-dazirewidibu.pdf
    • http://thymeouttravel.voyagerwebsites.com/uploads/1/3/0/5/130550833/130550833.html#bsc+agriculture+forestry+colleges+in+karnataka
    • http://www.heywildflowe

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003a3d.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3A3D 16036 bytes
font_01_sfnt_off00005178.bin
7493e50fff33feb0c1c7a8e409d91c4ceb6ebf11dbf7c0f0ef9a237b9b717536		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5178 8264 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.