Malicious PDF — malware analysis report

Static analysis result for SHA-256 396924adaf52c89f…

MALICIOUS

PDF

69.2 KB Authoring application: Solid Converter PDF
MD5: 5c74657fe47a6eb87e9dd97039c5ff90 SHA-1: 255948316a11cf663d7000fcca2b093bf8de5ed6 SHA-256: 396924adaf52c89f41ded6149a12632c5aa46e0ea89c4979586c73fd97bacc58
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was detected by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a large number of embedded external PDF links, indicating a potential link farm or redirection mechanism. The document body contains garbled text, suggesting it is not intended for direct user interaction but rather as a container for these links.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mta-sts.top-natural.com/uploads/1/3/0/6/130620956/7c41bef0afd.pdf
    • http://oneactioncalendar.org/uploads/1/3/0/6/130622092/19af62.pdf
    • http://theflowerpower.net/uploads/1/3/0/5/130547486/1751a0543.pdf
    • http://hoofmanship.com/uploads/1/3/0/5/130588688/kilelebeper-gesexevejipo-pukonawatu-luzukinin.pdf
    • http://rejuvenatedsoul.com/uploads/1/3/0/5/130590325/4148538.pdf
    • http://www.scottpadillapsyd.com/uploads/1/3/0/3/130313454/1f16d500.pdf
    • http://ncslp.com/uploads/1/3/0/3/130323674/kumovogotinuda.pdf
    • http://scholarshipsandgrants.school/uploads/1/3/0/5/130550832/2373462.pdf
    • http://plantationpest.net/uploads/1/3/0/6/130604018/1a32c22e.pdf
    • http://oaklandcommunitycouncil.org/uploads/1/3/0/6/130621832/1266194.pdf
    • http://normanbrickandmasonry.com/uploads/1/3/0/7/130739619/govelob.pdf
    • http://mountainmotoadventures.com/uploads/1/3/0/7/130738625/vekimipuvum.pdf
    • http://capitalmetal.com/uploads/1/3/0/7/130740078/2463767.pdf
    • http://simply-sarah.co.uk/uploads/1/3/0/6/130639966/dabuku_jatatap_jedoxejen_japiwin.pdf
    • http://scottbelleri.com/uploads/1/3/0/6/130604931/wikojavoriz.pdf
    • http://thefourfuries.com/uploads/1/3/0/7/130739150/1eeda4b1ac80.pdf
    • http://escorti-milano.com/uploads/1/3/0/2/130287847/130287847.html#doa+surah+al+waqiah+rumi

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off00007119.bin
a2b478e0d0cd262d431ccec2884c8fb0790f480a2b717b4c4263b9493b11c91a		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x7119 31500 bytes
font_01_sfnt_off0000a30c.bin
b5a96b14abefb1d5caf7757768aa4b2accfa408b953cb162a4426f4250bad9d5		 pdf-font-stream PDF embedded font (sfnt) at offset 0xA30C 7000 bytes
font_02_sfnt_off0000b6eb.bin
2c04fd3d2bdcbf62675786c5faf21f741442fc8fa5f5c0ea6cf0969b02db2398		 pdf-font-stream PDF embedded font (sfnt) at offset 0xB6EB 7440 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.