Malicious PDF — malware analysis report

Static analysis result for SHA-256 1feba2d38b3288ba…

MALICIOUS

PDF

62.5 KB Authoring application: Pdftk
MD5: 3f4598807a00758863c9d381c6d8202f SHA-1: 015c50d95b3a28325aecd999970bcd5026000cf8 SHA-256: 1feba2d38b3288ba112a4fae71161bc9de30f5e494e5d998bf14c45aa80d9b6c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was detected as malicious by ClamAV with the signature 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. Static analysis revealed a large number of embedded external links, indicating a potential link farm used for SEO manipulation or to distribute further malicious content. The document body contains garbled text and metadata suggesting it was generated by Pdftk, and the embedded URLs are likely the primary mechanism for delivering the malicious payload.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://herbalalliance.org/uploads/1/3/0/8/130813883/xabaponolame.pdf
    • http://www.g-pod.com.au/uploads/1/3/0/4/130489434/caa3db9fe01f.pdf
    • http://uniquelychicboutiquebysher.com/uploads/1/3/0/2/130287735/5247817.pdf
    • http://perstaxllc.com/uploads/1/3/0/6/130621890/peribuxuluxi.pdf
    • http://webdisk.bertacchibuilders.com/uploads/1/3/0/3/130323187/japola.pdf
    • http://biztagram.com/uploads/1/3/0/2/130272271/ladasufanirosovuvom.pdf
    • http://dramallamaranch.com/uploads/1/3/0/3/130313299/206893.pdf
    • http://howtoconference.net/uploads/1/3/0/6/130604682/c6613d632ee76e.pdf
    • http://moralityinthemarketplace.com/uploads/1/3/0/7/130738996/6759648.pdf
    • http://ultracooltrends.com/uploads/1/3/0/6/130603900/8b4cb4ee3c977.pdf
    • http://tkgip.com/uploads/1/3/0/5/130539728/timoguvoredalizefe.pdf
    • http://dogparkmaps.com/uploads/1/3/0/7/130776239/1f41f.pdf
    • http://brianherrick.net/uploads/1/3/0/7/130775205/sevapavomujet.pdf
    • http://brisbaneblonde.com/uploads/1/3/0/5/130547527/jodaraj_pejis_nogoba.pdf
    • http://ladichadeserlibre.com/uploads/1/3/0/7/130740502/tupise.pdf
    • http://www.adelaideamend.com/uploads/1/3/0/6/130605175/segisibebipolu.pdf
    • http://hostmaster.kultur-austausch.ch/uploads/1/3/0/7/130738883/4266421.pdf
    • http://ccanational2019store.com/uploads/1/3/0/2/130271073/2231242.pdf
    • http://rhema-africa.net/uploads/1/3/0/4/130488851/bezovaroxom_penepanowenotaw_nutevula_godume.pdf
    • http://www.faith-n-fashion.com/uploads/1/3/0/6/130639905/b45609849351be1.pdf
    • http://declareyourday.com/uploads/1/3/0/6/130639926/cda3281848b.pdf
    • http://myheritagefence.com/uploads/1/3/0/5/130539735/miwijifegom.pdf
    • http://legacyofstoke.com/uploads/1/3/0/6/130605430/weritoredimetim.pdf
    • http://eng-kayla-j.pleasingfood.com/uploads/1/3/0/7/130775118/130775118.html#agnes+obel+september+song+soundtrack

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001703.bin
63b75e06afaf3ddaaac43999175a1bf3b3d70c5a2b0f6f9439b540cab6080b9b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1703 11292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.