Malicious PDF — malware analysis report

Static analysis result for SHA-256 30ff60b94a4750c9…

MALICIOUS

PDF

30.5 KB Authoring application: Adobe PDF Library 9.0
MD5: 53a82b5d04cebc6a45b16f58b61efd63 SHA-1: 97dd9dd5f07806eb7a894f2635ff65fee5b4de38 SHA-256: 30ff60b94a4750c99a073ab27576c625dc7956881bbe61204ab2c28147d8e8f4
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files on various domains. This behavior is consistent with SEO spam or a phishing campaign designed to drive traffic to malicious content. The ClamAV detection also flags it as phishing-related. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://spelotheken.org/uploads/1/3/0/5/130539679/tutoru-xunafutosuvate.pdf
    • http://www.loum.com/uploads/1/3/0/3/130313491/nobimozolifib.pdf
    • http://www.restoremassagect.com/uploads/1/3/0/2/130274319/juguzetuminuxuki.pdf
    • http://www.livingwiththelairds.com/uploads/1/3/0/5/130539042/56766.pdf
    • http://kareego.net/uploads/1/3/0/7/130776197/dc5f18d6b.pdf
    • http://tps138.news/uploads/1/3/0/5/130539095/fubesar-nebexagonufulu-wudafetasi.pdf
    • http://fly360green.org/uploads/1/3/0/6/130640225/ecefb55ca94a25.pdf
    • http://alisoncarbonel.com/uploads/1/3/0/6/130621108/2b37b20737.pdf
    • http://1hrloan.com/uploads/1/3/0/6/130621020/lerebafabubipelerak.pdf
    • http://spiritualbeautyandhealth.org/uploads/1/3/0/7/130739029/jakodiwukewiz.pdf
    • http://www.pct4career.com/uploads/1/3/0/6/130621072/ravedoxega-loxasure-viwesamero-ganuvamuxug.pdf
    • http://northland.rocks/uploads/1/3/0/4/130436007/rewurovijubepi-vepano.pdf
    • http://www.geraldedwardross.com/uploads/1/3/0/8/130874641/1045864.pdf
    • http://gorodskoiokrug.site/uploads/1/3/0/2/130289336/rujub_wumuwukapidu_valobumonijizut_mikevumopupila.pdf
    • http://toefltraining.com/uploads/1/3/0/5/130540072/siwasaz.pdf
    • http://mkelectricllc.net/uploads/1/3/0/6/130621568/modowajiro_muparukalo.pdf
    • http://kilo-kings.com/uploads/1/3/0/5/130540507/pevomaxetumizir_zowinadusem_zudun.pdf
    • http://amorcocoa.com/uploads/1/3/0/4/130435784/senobez.pdf
    • http://imagesbyannmarie.com/uploads/1/3/0/2/130287727/zivonafafod_radijatoni_xixovixajebib_xalagajo.pdf
    • http://northparkvoicestudio.com/uploads/1/3/0/5/130540592/wudilusixamepali.pdf
    • http://helpking.org/uploads/1/3/0/3/130323743/130323743.html#rust+oleum+yellow+striping+paint+sds

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000018d6.bin
0fc9b55a7d12faadb625971c61b410729bbc5813dbe8317eb407bcbb265fc81a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x18D6 7068 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.