Malicious PDF — malware analysis report

Static analysis result for SHA-256 2630b3bb4865e18e…

MALICIOUS

PDF

72.5 KB Authoring application: PDF Studio
MD5: 460dc22f356fceec4db1522b8c150989 SHA-1: 85d13b3bb9f06afc247b24cdeafd284c3f972951 SHA-256: 2630b3bb4865e18e6bc57a57280630ea3e4bc458c8960e5b55ef309b3d6823f7
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various domains, suggesting a link farm or a method to distribute malicious content or manipulate search engine results. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a phishing or traffic-driving intent. No scripts were extracted, and the document body is heavily obfuscated, limiting further analysis of the specific lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mrsottocounselingcorner.com/uploads/1/3/0/4/130476207/af692a64b2b0a.pdf
    • http://thewardrobesquad.com/uploads/1/3/0/3/130313790/wemumir.pdf
    • http://fecresources.net/uploads/1/3/0/6/130604215/fikon.pdf
    • http://hifuckers.com/uploads/1/3/0/4/130479435/kebisezimefivagab.pdf
    • http://advbiocom.com/uploads/1/3/0/3/130379354/tanefuliwira_gudupulutepu_pulasu_suxef.pdf
    • http://microschoolontherise.com/uploads/1/3/0/7/130775729/zuvemegod.pdf
    • http://cleaningservicesresidentialcommercial.com/uploads/1/3/0/5/130551230/25bb23d697517d8.pdf
    • http://electricianmartincounty.com/uploads/1/3/0/5/130539097/pidawavatifemida.pdf
    • http://fashionitaly.net/uploads/1/3/0/2/130273735/sibev.pdf
    • http://sousmarine.de/uploads/1/3/0/5/130543148/7523732.pdf
    • http://forestavenuemedical.com/uploads/1/3/0/5/130550741/notupivodix-josefotimokole-bofevurazosak.pdf
    • http://siskiyouespressotech.com/uploads/1/3/0/2/130289523/e1ca52be7d59f2e.pdf
    • http://premierrecruiting.net/uploads/1/3/0/4/130489833/namevexojotovi.pdf
    • http://sallykfrey.com/uploads/1/3/0/2/130289799/8061c.pdf
    • http://sublimepainting.net/uploads/1/3/0/6/130640214/2846ba.pdf
    • http://zealventures.net/uploads/1/3/0/8/130813757/7512a79.pdf
    • http://idonutcare.net/uploads/1/3/0/8/130814644/cbd8093673.pdf
    • http://alanpliuart.com/uploads/1/3/0/6/130639377/38172f39885fb.pdf
    • http://moodlabnewlife.nl/uploads/1/3/0/5/130551661/130551661.html#oscar+wilde+e+il+ritratto+di+dorian+gray

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000169a.bin
ce1abc373ee4ac71b5fc0cc5e6f62b41bd7f3aa557249cd430560ea026bf7a0b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x169A 11400 bytes
font_01_sfnt_off0000c9b4.bin
014a06d3ebcab26b292cd89b1c4156f34f806217642b385644bdac287d77828e		 pdf-font-stream PDF embedded font (sfnt) at offset 0xC9B4 16132 bytes
font_02_sfnt_off0000de8f.bin
73db1b0517a03a3ea453c43aa17591918c1b4579ef19e8986c06116ede1a3a54		 pdf-font-stream PDF embedded font (sfnt) at offset 0xDE8F 3836 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.