Malicious PDF — malware analysis report

Static analysis result for SHA-256 31f1a183525a0813…

MALICIOUS

PDF

37.3 KB Authoring application: Serif PagePlus
MD5: 57ed7f13291f174bc407a6a13ea390ce SHA-1: 23e97c9ec5039370aab793000eb1946c40818acb SHA-256: 31f1a183525a08134c9bad95d0a7c8185b6e376ff892561119bed359d58e8421
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This technique is commonly used for SEO poisoning or to distribute malicious content. The ClamAV heuristic also flags this as a phishing-related threat. No scripts were extracted, and the document body was truncated, limiting further analysis of the specific lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://accomozcontact.com/uploads/1/3/0/8/130813609/lobawejegunimiv.pdf
    • http://romanacoutureshop.com/uploads/1/3/0/6/130604749/796372.pdf
    • http://ohheglows.com/uploads/1/3/0/7/130740257/pemas.pdf
    • http://sonhab.com/uploads/1/3/0/3/130324420/bijijebitetekinomit.pdf
    • http://mta-sts.mail.performancevistas.org/uploads/1/3/0/3/130313619/dikirusevuwedereluk.pdf
    • http://solopianostylings.com/uploads/1/3/0/6/130622042/wawowiregigonoj-kegumonope.pdf
    • http://roskita.com/uploads/1/3/0/8/130813144/dipomixorutuz_wikuditunuxuz_lobufotejefamu.pdf
    • http://passmankade.com/uploads/1/3/0/5/130589399/rijinemefe.pdf
    • http://sperorebuilt.com/uploads/1/3/0/3/130379274/tijamumelifo.pdf
    • http://eshadeshpande.com/uploads/1/3/0/7/130775728/pefinaxepal.pdf
    • http://jinbangyulechengkefu.br3h.com/uploads/1/3/0/4/130478704/dbb6a8b.pdf
    • http://kbkornholegames.com/uploads/1/3/0/5/130550684/vivinifufomojab.pdf
    • http://cyber1risk.com/uploads/1/3/0/3/130313263/fokiti-rafut.pdf
    • http://dominiondistillers.com/uploads/1/3/0/4/130436152/8626965.pdf
    • http://sacredsecretskincare.org/uploads/1/3/0/2/130270763/dc732a4f705ab.pdf
    • http://foveroltd.com/uploads/1/3/0/2/130271234/jolof.pdf
    • http://loftsalonriverside.com/uploads/1/3/0/7/130740256/malogoneluzobipap.pdf
    • http://dearrouge.ca/uploads/1/3/0/2/130289411/6079a95b176.pdf
    • http://resourcesforthesoul.com/uploads/1/3/0/7/130776811/xuwar.pdf
    • http://moneymonologues.com/uploads/1/3/0/7/130775088/dokifiberaxok.pdf
    • http://ruben-moss.pleasingfood.com/uploads/1/3/0/7/130740259/130740259.html#rutina+de+ejercicios+para+gluteos+piernas+y+abdomen+con+pesas
    • http://solopianostylings.com/uploads/1/3/0/6/130622042/wawowiregigonoj

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003187.bin
ec2bb1e3d40353574d2f6626f8ed3db5a494860c3e307b673be31c948fe5b0c4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3187 8680 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.