Malicious PDF — malware analysis report

Static analysis result for SHA-256 316eb56124a35fce…

MALICIOUS

PDF

40.5 KB Authoring application: Smallpdf Desktop
MD5: 63812b0389c09e236b7ae499ba31577d SHA-1: c4761ccc1d4227b601159c27f305cc31b51989c6 SHA-256: 316eb56124a35fceeac5cf2fbad610cbd3c4005c0317914aa8de4f363e27fecb
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further indicates a phishing or traffic redirection intent. The embedded URLs are likely used to direct users to malicious content or phishing pages. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://minashallmark.dadgifts.us/uploads/1/3/0/6/130621152/rupanofetupid.pdf
    • http://fiercetruth.net/uploads/1/3/0/2/130273788/54ef31f8a0f0bf1.pdf
    • http://azurebuildingservices.biz/uploads/1/3/0/4/130436298/7134480.pdf
    • http://vintagechicanew.com/uploads/1/3/0/7/130739983/legusuxabevaze_motodurozekag_muzuxosaj_norunawidumok.pdf
    • http://tiantianboshishicai.br3h.com/uploads/1/3/0/7/130738819/jatatopiget.pdf
    • http://guitarhugs.com/uploads/1/3/0/3/130323295/migipefotajizenabe.pdf
    • http://www.romseyrooms.com.au/uploads/1/3/0/5/130544754/ffd50919f4.pdf
    • http://www.mydriveandcash.com/uploads/1/3/0/3/130379354/zubodubirerapebu.pdf
    • http://onemovingpart.info/uploads/1/3/0/6/130639960/mezitufivenibar_gejurisafore_naneronaziju.pdf
    • http://calldavid.com/uploads/1/3/0/7/130776315/6058475.pdf
    • http://beesea.com/uploads/1/3/0/5/130588290/ximozalazegikoxala.pdf
    • http://christopherjarvis.co/uploads/1/3/0/5/130550891/7b0473a929c0d0.pdf
    • http://allisongentry.com/uploads/1/3/0/5/130544321/pidunilujadigijebod.pdf
    • http://vep-systems.co.uk/uploads/1/3/0/4/130476733/3710881.pdf
    • http://doitmovin.com/uploads/1/3/0/5/130588428/megurofepavat.pdf
    • http://bushthornlodge.co.za/uploads/1/3/0/3/130379158/fowekodox-fifeneg-ravajidoletezaw.pdf
    • http://lcdhh.org/uploads/1/3/0/6/130605516/b657d2fb0f3fb4.pdf
    • http://cardboardbuild.com/uploads/1/3/0/6/130620492/vafavekidus_mabup_tuxebadojetid_javavix.pdf
    • http://colinaway.com/uploads/1/3/0/3/130323697/zokamevifumof.pdf
    • http://www.blush-boutique.shop/uploads/1/3/0/2/130272649/7892aa54be3.pdf
    • http://rekharbhandarkar.com/uploads/1/3/0/4/130483265/70c7eec.pdf
    • http://www.rehabjuicecompany.com/uploads/1/3/0/7/130776445/130776445.html#hernan+cortes+biografia+para+ni%C3%B1os

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003d2c.bin
dfc742e2712500a27bee716300591715eba3321cb91a2fceeead018e6b428997		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3D2C 8632 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.