Malicious PDF — malware analysis report

Static analysis result for SHA-256 3d3bda92405aacf9…

MALICIOUS

PDF

47.1 KB Authoring application: QPDF
MD5: 4ea59069f2c11aa024e340ad5cf23fd8 SHA-1: 0d582d6d518d76857f394e8aeeccb9660066af0c SHA-256: 3d3bda92405aacf9d3efafddcb622dd859db87de3642e613c61cc8c7d06a76b2
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a mass external link farm pointing to numerous PDF files hosted on various domains, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further indicates a phishing or malicious intent. The presence of a visual download button lure reinforces the deceptive nature of the document. The primary goal appears to be directing users to download further malicious content from the listed URLs.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://employerservices.ca/uploads/1/3/0/5/130543065/sorinarok.pdf
    • http://www.stuckeymedia.com/uploads/1/3/0/2/130288729/5091043.pdf
    • http://www.small-product-photography.com/uploads/1/3/0/2/130289649/vorifepogur.pdf
    • http://blackdragonvodka.com/uploads/1/3/0/6/130639062/e945ee8.pdf
    • http://norwichladsabc.co.uk/uploads/1/3/0/7/130738712/xemivi_daluno.pdf
    • http://www.shop-a-little.com/uploads/1/3/0/7/130776599/jazizejol.pdf
    • http://milkywayshirt.com/uploads/1/3/0/7/130738759/pakisar.pdf
    • http://wallaroostoragesolutions.com/uploads/1/3/0/7/130739660/sorodi.pdf
    • http://bucharestinthebeltway.com/uploads/1/3/0/8/130815115/cae4bd1f6f99a52.pdf
    • http://tourguidela.com/uploads/1/3/0/5/130545742/f8690be65d4c.pdf
    • http://huboyulechengzhucedexianjin.br3h.com/uploads/1/3/0/5/130538996/buxixerokadam.pdf
    • http://mta-sts.surplus-lighting.com/uploads/1/3/0/5/130589297/73594.pdf
    • http://www.dpo-recrutement.com/uploads/1/3/0/9/130969054/liperisogun.pdf
    • http://crystalcrones.com/uploads/1/3/0/6/130605069/9221387.pdf
    • http://viryacommunications.com/uploads/1/3/0/5/130589239/fetafebeb.pdf
    • http://defenderofthemeek.com/uploads/1/3/0/7/130739655/bafil.pdf
    • http://mrcrosbyswebsite.com/uploads/1/3/0/4/130483830/399436.pdf
    • http://www.liznash.com/uploads/1/3/0/7/130776866/9736760.pdf
    • http://madewithlasers.net/uploads/1/3/0/3/130313388/68660ad39941f.pdf
    • http://onlinemobiletrainer.com/uploads/1/3/0/2/130287914/c3f8b89032f.pdf
    • http://alwaysfuntravel.voyagerwebsites.com/uploads/1/3/0/5/130551925/130551925.html#pdf+editor+app+free
    • http://milkywayshirt.com/uploads/1

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000043c5.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x43C5 16036 bytes
font_01_sfnt_off00005ab3.bin
390011b7f56623848edf507bc09e9358f5c8954aa74e3238ba38261babd83766		 pdf-font-stream PDF embedded font (sfnt) at offset 0x5AB3 7380 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.