Malicious PDF — malware analysis report

Static analysis result for SHA-256 2163f698656bccae…

MALICIOUS

PDF

55.1 KB Authoring application: GIMP
MD5: 3dc9aa237194559b93500b068355621e SHA-1: 430e2bf93faadd456f7d227f66f3665fb4913acf SHA-256: 2163f698656bccae8589ee4200180f631ed979539b266242a3f7531f3ba0927c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ddsdelightsonline.com/uploads/1/3/0/7/130740087/6165f8ed.pdf
    • http://www.letarotiste.com/uploads/1/3/0/5/130550714/c79fb.pdf
    • http://carloslago.net/uploads/1/3/0/8/130813732/4c465b5370d0e0.pdf
    • http://callananfitclub.com/uploads/1/3/0/7/130739449/5071097.pdf
    • http://geniuspath.ai/uploads/1/3/0/7/130775201/1599367.pdf
    • http://www.vbcportland.com/uploads/1/3/0/4/130483086/gewadukosu.pdf
    • http://ezekius.net/uploads/1/3/0/4/130478203/konuxikubutogejip.pdf
    • http://www.greaterseattlehypnosis.com/uploads/1/3/0/6/130639781/5981899.pdf
    • http://miraclevalleyceylon.com/uploads/1/3/0/5/130540461/goregopoma.pdf
    • http://www.imagefactorybelize.com/uploads/1/3/0/6/130605217/1475859.pdf
    • http://tshutter.com/uploads/1/3/0/4/130490875/rerad-gelopif-gibura-zolosirojuze.pdf
    • http://www.helsekostbutikker.dk/uploads/1/3/0/7/130775589/2870685.pdf
    • http://ocmedicare.net/uploads/1/3/0/7/130776592/9781607.pdf
    • http://hamish-brown.com/uploads/1/3/0/5/130589163/bf80b67.pdf
    • http://lynneotis.com/uploads/1/3/0/9/130969896/rifibuvasa_kubeso.pdf
    • http://mollyvstreiff.com/uploads/1/3/0/5/130542852/2779536.pdf
    • http://camping-hire-and-sales.com/uploads/1/3/0/6/130621765/5c933ca35015f.pdf
    • http://mtsarmusic.com/uploads/1/3/0/2/130272360/f306b458d2f7d.pdf
    • http://medisinskutstyr.com/uploads/1/3/0/2/130287919/xogan.pdf
    • http://kc4kah.com/uploads/1/3/0/5/130546645/bejasowosif.pdf
    • http://wheelhouse.theater/uploads/1/3/0/2/130289279/7357084.pdf
    • http://offthepier.net/uploads/1/3/0/6/130621312/3073387.pdf
    • http://74-123-78-111.mgwnet.com/uploads/1/3/0/8/130874079/130874079.html#maths+formula+in+hindi+pdf+file
    • http://www.helsekostbutikker.dk/uploads/1/3

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000452a.bin
1723f1ced37cc89d69e30f3df6281c5e5fb8989544fd4587aa75b00c91af2fd0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x452A 1388 bytes
font_01_sfnt_off00004ee3.bin
57fdba1302c21f7ca1df854aa6886a6c177eac5e68ff46faa5d9e70128b6c240		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4EE3 14560 bytes
font_02_sfnt_off000077d2.bin
2859ff8727e67bdb6ac29119b6bf9722dd560d7ca75f198cd8552be6e87032e5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x77D2 7632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.