Malicious PDF — malware analysis report

Static analysis result for SHA-256 3732e5cfce0866fa…

MALICIOUS

PDF

42.4 KB Authoring application: ImageMagick
MD5: 91a7369db6948ea86c0930899d33fe14 SHA-1: acbbc455c644f8df562fc1aceb15c6c767718068 SHA-256: 3732e5cfce0866fa7c3a0106d3b0a2c7b095dacdca4d31bf314c1b9682835baf
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a phishing campaign designed to distribute malicious content or manipulate search engine results. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the phishing and traffic redirection nature of this file.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lovemugshop.com/uploads/1/3/0/5/130543368/8900458.pdf
    • http://naturalkinksinthecreek.com/uploads/1/3/0/6/130620249/sideta.pdf
    • http://manawell.net/uploads/1/3/0/6/130603935/bisanodekujibogob.pdf
    • http://denversteynfitness.com/uploads/1/3/0/5/130541623/xisatejunafuratetuf.pdf
    • http://palliativecareforuganda.com/uploads/1/3/0/6/130620942/3984974.pdf
    • http://sideoftheroad.life/uploads/1/3/0/2/130289550/bukufokebevubi.pdf
    • http://shipfree.club/uploads/1/3/0/5/130538949/zexagigewo-koxetojamaloki.pdf
    • http://mybestloanrate.com/uploads/1/3/0/4/130489572/9359125.pdf
    • http://miupnorthwedding.com/uploads/1/3/0/7/130739328/nuganobe-bifuzo-xogaw-fusixitiwos.pdf
    • http://www.creativeofficesf.com/uploads/1/3/0/9/130969332/sitema.pdf
    • http://mklodging.com/uploads/1/3/0/6/130620889/rifosoxe.pdf
    • http://anchoredbydesign.shop/uploads/1/3/0/2/130291662/pavebizi.pdf
    • http://salespresentationskills.org/uploads/1/3/0/6/130622068/6051171.pdf
    • http://pikminlink.com/uploads/1/3/0/7/130776616/senix_xojofatezetevu.pdf
    • http://witchsrosary.com/uploads/1/3/0/6/130604422/gajofujazajava-xituvetin.pdf
    • http://webdisk.digcitinstitute.com/uploads/1/3/0/2/130272086/130272086.html#trouble+free+pool+lower+total+alkalinity

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004c53.bin
c26db976b6efe1ab4e373b6a447a515d1e5523176bfcd1c68e0eb5d97d43f138		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4C53 7568 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.