Malicious PDF — malware analysis report

Static analysis result for SHA-256 21ba91e338c74a7f…

MALICIOUS

PDF

54.5 KB Authoring application: GIMP
MD5: 3b6f750ce83ed90267d3298520b5ac64 SHA-1: a2930b43475d1517d725a45fd1a32bfd7e2d19b9 SHA-256: 21ba91e338c74a7f629ecad1fb1285733e9978e6eab4cf2a91febd5b388e6014
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a heuristic firing for PDF_SEO_LINK_FARM, indicating a large number of external links. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. The embedded URLs point to various PDF files and an HTML page, suggesting a link farm designed to redirect users. The document body contains garbled text but also lists several URLs, reinforcing the link farm attack pattern.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL https://zideripigitamif.weebly.com/uploads/1/3/0/5/130588625/nijisitumozo_tupodozopixa.pdf
    • http://bardfamilymarketgarden.com/uploads/1/3/0/6/130639042/3b685f7.pdf
    • http://northsidecigars.com/uploads/1/3/0/5/130589309/fodupakaxagekolow.pdf
    • http://milindian.com/uploads/1/3/0/6/130620354/6a8124d63b5.pdf
    • http://michaelshusko.com/uploads/1/3/0/3/130313336/130313336.html#love+yourself+answer+f+version+ebay

Extracted artifacts 4

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_004_off00007195.bin
e5b5227f86e7c20a43e6d57e53bc90600a134297664f4d55a44cae47822278b7		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7195 20984 bytes
font_00_sfnt_off000010ed.bin
f8228e88ee067468c105f82767bf12c05faf66f483b17f0587cc89d9acb461c9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10ED 9492 bytes
font_01_sfnt_off00005ac7.bin
e558bec40309ff73e825d230cfcd2ca3d36362cc91118506e5166e5d8e18e28f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5AC7 12464 bytes
font_03_sfnt_off000092c3.bin
87faad0814e5f5c6d464e89004059d644943070e64536735b483037ed558b7af		 pdf-font-stream PDF embedded font (sfnt) at offset 0x92C3 5404 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.