Malicious PDF — malware analysis report

Static analysis result for SHA-256 1e457fe5719be0c0…

MALICIOUS

PDF

48.3 KB Authoring application: Adobe PDF Library 9.0
MD5: 41c29d6b20896f0ba054cffb50d89889 SHA-1: accb43628683a052b2961c896809f87d55f42fb1 SHA-256: 1e457fe5719be0c092b7212c3254225868930c78d56ba0fa710e200a34552d4c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a PDF_SEO_LINK_FARM heuristic firing, indicating the presence of a large number of external links within the document. These links, such as http://acehomecareservicewherewe.com/uploads/1/3/0/3/130313105/006c24be7b6d4.pdf, are likely intended to manipulate search engine results or redirect users to malicious content. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://acehomecareservicewherewe.com/uploads/1/3/0/3/130313105/006c24be7b6d4.pdf
    • http://naturalroofingslates.net/uploads/1/3/0/2/130289344/giluzisadiwu.pdf
    • http://ndcca2016.com/uploads/1/3/0/2/130288316/kubeburopupof-forurivujaruj-gerawatariw-zivunulugote.pdf
    • http://fundr.ca/uploads/1/3/0/5/130539936/jajarikejikupug_bukudojomu_nuselixefiper.pdf
    • http://preparedplanet.net/uploads/1/3/0/4/130483370/nugaxofotumegipez.pdf
    • http://toptreeservicerosevilleca.com/uploads/1/3/0/3/130323962/nadavolit.pdf
    • http://nevermoreacrespetrescueinc.com/uploads/1/3/0/3/130323301/magezizapirukeros.pdf
    • http://natashaforouzannia.net/uploads/1/3/0/4/130489933/71a1418032.pdf
    • http://djpoolie.com/uploads/1/3/0/2/130274145/radumunukusadize.pdf
    • http://soorulasteaed.weebly.com/uploads/1/3/0/3/130323547/b5eb8.pdf
    • http://cetonantzin.org/uploads/1/3/0/6/130620365/9311022.pdf
    • http://buzav.japher.site/uploads/2020/01/28/ea617b1ad89e752.pdf
    • http://mhrandlenovels.com/uploads/1/3/0/6/130639972/130639972.html#dhakad+chhora+film+video

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000150c.bin
28c357c47e746cd52a793940d53e9ff3ef634336b1128771afbd5c7a67ffa27c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x150C 8896 bytes
font_01_sfnt_off000060f5.bin
7f34212c6f1d49e949877209968bdfe707cbd807530898ab97ef6dfcdb8fc8d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x60F5 16888 bytes
font_02_sfnt_off000077d1.bin
8fc90a8c794c5e4edd02eb576d298900e852af81768fed2d28bb05792f26071b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77D1 7356 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.