Malicious PDF — malware analysis report

Static analysis result for SHA-256 3ce8078f35f4bb38…

MALICIOUS

PDF

34.9 KB Authoring application: QPDF
MD5: 63edf3455dc43f63ff2c26e7ce6804b9 SHA-1: 006e755c36ed66710618acf777eb82b35a7bd507 SHA-256: 3ce8078f35f4bb38b3bd4176243f03c6baaa0bd8b564e0cc010f8042f35bd5be
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique commonly used for phishing or distributing malware. The heuristic 'PDF_SEO_LINK_FARM' specifically flags this behavior, indicating a link farm designed to redirect users. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious classification. The embedded URLs are the primary IOCs, likely leading to malicious content.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://198crestavista.com/uploads/1/3/0/5/130538891/fikuselibale-xilokogilegefuk-wogelax-juveluvamu.pdf
    • http://araratmining.com/uploads/1/3/0/7/130775413/benapadofut-tupenum-logagu.pdf
    • http://denvergranitedepot.com/uploads/1/3/0/7/130775016/799458ea7ed472e.pdf
    • http://narayanahotelandresidences.com/uploads/1/3/0/4/130483396/jolejomogujege.pdf
    • http://www.iguazufallstour.net/uploads/1/3/0/3/130323100/webepo.pdf
    • http://captainviolet.com/uploads/1/3/0/7/130740235/2487433.pdf
    • http://noveltylabs.com/uploads/1/3/0/2/130272591/zabosotuvadabemib.pdf
    • http://love-in-the-afternoon.com/uploads/1/3/0/3/130313504/koxegikof-goxir-roxotomapotaz.pdf
    • http://minecraftray.site/uploads/1/3/0/7/130775626/bapemilatab-petinuxiritos.pdf
    • http://mta-sts.mail.calvarynewlifesa.com/uploads/1/3/0/7/130739949/78517.pdf
    • http://www.weshiftparadigms.com/uploads/1/3/0/6/130605212/lufalozupedakoz.pdf
    • http://mpassociatesrealtors.com/uploads/1/3/0/5/130541743/b93314.pdf
    • http://www.themoonandmeapothecary.com/uploads/1/3/0/2/130271142/130271142.html#brts+bus+route+map+ahmedabad

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003077.bin
3a3946d2d83b1337bc0e7a6486a90e588492a41cf7a84602a5bef1f2213485bb		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3077 7724 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.