Malicious PDF — malware analysis report

Static analysis result for SHA-256 3f897452045811b5…

MALICIOUS

PDF

38.9 KB Authoring application: Poppler-utils
MD5: 4f62ca08fff12b7e8bb34416514a5bd7 SHA-1: 6c7cff3d905f0372617bfa6e89bbb3e2e122e5bf SHA-256: 3f897452045811b5fe2b5f11f4c3f2b7f8b422925a387ba8acedd3157bdc9f6c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection indicates this is a known phishing or malicious redirection pattern. The embedded URLs are likely used to direct users to potentially harmful websites.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://prettybakedqueens.com/uploads/1/3/0/6/130620606/pirix.pdf
    • http://teamwhenlambo.com/uploads/1/3/0/6/130621032/paragireg-gakatanu-redekexapu-pujujamenulovak.pdf
    • http://lifetobedetermined.com/uploads/1/3/0/7/130740368/nukukobukabe.pdf
    • http://archivistar.com/uploads/1/3/0/6/130621082/e56a96695ed.pdf
    • http://soulspeakmarketing.com/uploads/1/3/0/5/130588509/livizowopafed_vonig_xegewawuvafizir_giwetexeje.pdf
    • http://www.upstatescchapterofahna.com/uploads/1/3/0/2/130289279/3274802.pdf
    • http://olivegroveresort.com/uploads/1/3/0/5/130546457/novisuwazufiwon.pdf
    • http://www.romillyslimes.com/uploads/1/3/0/5/130550814/gituroburuna.pdf
    • http://blackblossombeauty.com/uploads/1/3/0/4/130436367/9759230.pdf
    • http://drterris.com.au/uploads/1/3/0/4/130476390/2974d70a7d86.pdf
    • http://michaelrekas.com/uploads/1/3/0/2/130274269/3e430.pdf
    • http://timeporters.net/uploads/1/3/0/7/130739169/3b4ab17a.pdf
    • http://www.itworksgirl.shop/uploads/1/3/0/6/130620728/boxeju.pdf
    • http://unionofbliss.com/uploads/1/3/0/5/130543494/nuziwi-lejisek.pdf
    • http://www.stillridgeranch.ca/uploads/1/3/0/7/130738721/fevomeromirujir.pdf
    • http://percy-macuinn.pleasingfood.com/uploads/1/3/0/7/130776356/130776356.html#crochet+baby+dress+patterns+free

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003d2c.bin
6d957c64ad971f314fd8d27fbc11ccd2b8fc2d126c09bce49374b3b608cd8ba7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3D2C 8028 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.