Malicious PDF — malware analysis report

Static analysis result for SHA-256 3255ee35d5a6f4ed…

MALICIOUS

PDF

36.8 KB Authoring application: ImageMagick
MD5: 7aa1a00ebb6d9e28154d3a0880c2fef7 SHA-1: d58a4fad3d489d861c493ca01634b40a06a98b49 SHA-256: 3255ee35d5a6f4ed15232a4c93e5d7ca14d54c9201033b30576ded6d00ac6809
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified as a 'PDF_SEO_LINK_FARM' heuristic. The primary URL, http://vatspeak.com/uploads/1/3/0/2/130274376/77d133297461.pdf, is part of this link farm. This suggests the document is designed to redirect users to potentially malicious content hosted on numerous domains, a common tactic for phishing or malware distribution. The ClamAV detection further supports its malicious nature.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://vatspeak.com/uploads/1/3/0/2/130274376/77d133297461.pdf
    • https://levoluxab.weebly.com/uploads/1/3/0/4/130436339/19f96914e62360.pdf
    • http://mspistone.com/uploads/1/3/0/5/130590219/zelitetorunamob-bemijojudufi-bofudawupo-fugekujigujaxef.pdf
    • http://alinacruzfengshui.com/uploads/1/3/0/2/130271128/902e44ecfc3892.pdf
    • http://avalonbeachpodiatry.com.au/uploads/1/3/0/3/130323355/nezif.pdf
    • http://mountaintechnicalsolutions.com/uploads/1/3/0/6/130604766/2220f74.pdf
    • http://retreatinsider.com/uploads/1/3/0/4/130435820/lowar.pdf
    • http://onceuponamonth.net/uploads/1/3/0/5/130543575/d8341f3c69bc39a.pdf
    • http://mirasbigday.com/uploads/1/3/0/4/130476204/b713c17.pdf
    • http://britmaritime.com/uploads/1/3/0/3/130312974/sokujanijaxug-bezes-dewuwuzudegiwup.pdf
    • http://averob.com/uploads/1/3/0/6/130620778/1e21567.pdf
    • http://bhagathalwai.com/uploads/1/3/0/4/130476605/xumoxaxexirujalotiz.pdf
    • http://oakclass.com/uploads/1/3/0/6/130605077/130605077.html#inpatient+and+outpatient+medical+reports

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001302.bin
70b9a0381200cfc8c4fcf042a63a1bcdc25aa87eccb9ad884a97e09b7754e955		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1302 7396 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.