Malicious PDF — malware analysis report

Static analysis result for SHA-256 4271ea0eef9e9094…

MALICIOUS

PDF

36.5 KB Authoring application: Solid Converter PDF
MD5: fe7615cb7e9263969ce86ca2d69f706f SHA-1: f4f72f478c310a1f76f43d524f9e216d41cffaef SHA-256: 4271ea0eef9e9094c5d28e2e6369e9642ed8ef45e17ebdd07ce61e9deda6d8ab
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to other PDF files hosted on various domains. This behavior is indicative of a link farm or a phishing campaign designed to redirect users to potentially malicious content. The ClamAV detection further supports the malicious classification.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://russianengineer.com/uploads/1/3/0/6/130620237/fujul-lofasomadev-jesatowujivi-nuxop.pdf
    • http://que-neni.com/uploads/1/3/0/6/130621280/deriretasejovimesave.pdf
    • http://clubedetrocaaltoparaiso.org/uploads/1/3/0/6/130604081/runezezar_lejemurud.pdf
    • http://thresholdsorganizingco.com/uploads/1/3/0/6/130604848/zoziwujukib_zesuxubon_bofubomabim.pdf
    • http://voyagescimatur.com/uploads/1/3/0/6/130639233/7892311.pdf
    • http://suitemeter.com/uploads/1/3/0/6/130639580/nizuxe_xepefez_fevekalux_tulukonabefoxi.pdf
    • http://escarabajo.ch/uploads/1/3/0/8/130813921/jebej.pdf
    • http://manchestercellarconversions.co.uk/uploads/1/3/0/5/130550743/fanebefe.pdf
    • http://trueiconic.net/uploads/1/3/0/7/130739934/5945788.pdf
    • http://oratert.host/uploads/1/3/0/5/130589159/559ac66.pdf
    • http://beyondbedside.com/uploads/1/3/0/5/130550912/bumivuni.pdf
    • http://johnshordike.net/uploads/1/3/0/6/130604515/nenizefenox_jelima_xarimizin_xomax.pdf
    • http://healthiersoils.com/uploads/1/3/0/6/130604892/kominunavogigewi.pdf
    • http://research-usa.com/uploads/1/3/0/2/130271207/tabuwisufi-lazalun-zududatub-xabanix.pdf
    • http://picton.school.nz/uploads/1/3/0/3/130323515/jawibakulixebasup.pdf
    • http://travelbysharon.voyagerwebsites.com/uploads/1/3/0/8/130813888/130813888.html#achilles+tendinopathy+exercises+youtube
    • http://picton.school.nz/uploads/1/3/0/3/130323515/jawibakul

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000033af.bin
fed50f6f081e0bb8bbe6c57eb3028eed5f0300d6f87df86357f72f8da003d0d0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x33AF 7828 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.