Malicious PDF — malware analysis report

Static analysis result for SHA-256 3b235e9c1b0478ad…

MALICIOUS

PDF

50.9 KB Authoring application: Mobipocket Creator
MD5: 6d624eb62c945870e81adbee33b9b210 SHA-1: 02b26ac227e3ac097a898c9cacd3f2c5551a7a54 SHA-256: 3b235e9c1b0478ad62271645bf9e2991fadad5229450c0b187b28aa6f938d927
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file was identified as malicious by ClamAV with the signature 'Pdf.Phishing.TtraffRobotInstall-7605656-0'. Static analysis revealed a significant number of embedded external links, indicative of a link farm designed to redirect users to potentially harmful content. The document body, though heavily obfuscated, contains references to these URLs, reinforcing the phishing or malware distribution intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://stylerolodex.com/uploads/1/3/0/7/130738889/2546134.pdf
    • http://nutri-net.fr/uploads/1/3/0/5/130588445/f133d51e5aa8e3.pdf
    • http://readyden.com/uploads/1/3/0/5/130551191/2632111.pdf
    • http://nora-pauli.net/uploads/1/3/0/4/130488098/c4ed5b1.pdf
    • http://dazmedia.net/uploads/1/3/0/5/130543028/safutipazilo_saxilino_vodopiludul_jiregemunabiku.pdf
    • http://potsandpets.com/uploads/1/3/0/6/130605218/144484.pdf
    • http://ndchair.com/uploads/1/3/0/4/130483422/130483422.html#active+passive+voice+exercise+class+9

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001102.bin
cb93aa0bbd09c28343c779d6af0cdc580a9c3455252972b0eb1690cc69952ed0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1102 8484 bytes
font_01_sfnt_off00007728.bin
fb31025025499a0fb01c3c1bd89e32baf051e66ef536a35089523545b6160756		 pdf-font-stream PDF embedded font (sfnt) at offset 0x7728 16248 bytes
font_02_sfnt_off00008c05.bin
908225b63e1717ce4d9443c39e5e0249165423a6f1725031e285b2c0c3b49b5f		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8C05 2148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.