Malicious PDF — malware analysis report

Static analysis result for SHA-256 44d5451531379bf7…

MALICIOUS

PDF

40.6 KB Authoring application: GIMP
MD5: 71891fa296605696587592faed0b91df SHA-1: 6f779806a427b80faaa7b128b9f00568a9757020 SHA-256: 44d5451531379bf78016c706c3fa83a5942e7388b7dbbc780d908c7821d639c4
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links likely serve to redirect users to malicious websites or to manipulate search engine rankings. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://lfsrm.net/uploads/1/3/0/2/130270874/kagemekerafozodepima.pdf
    • http://nickmosca.com/uploads/1/3/0/2/130287463/8c7b2dbe20.pdf
    • http://www.amandathomas.net/uploads/1/3/0/3/130323437/ac0d286ddf75.pdf
    • http://downtownperiodontalcenter.com/uploads/1/3/0/6/130620467/dodipurelob.pdf
    • http://snazzydiamonds.com/uploads/1/3/0/7/130739678/1b26654.pdf
    • http://ninacibulka.com/uploads/1/3/0/7/130776757/podexemizusifu_danesunet_nupiwepu.pdf
    • http://www.fredamwalker.com/uploads/1/3/0/5/130544191/vazasoxi.pdf
    • http://www.bidmcbreasturgeryfellow.com/uploads/1/3/0/6/130620511/8422595.pdf
    • http://www.ethansodoma.com/uploads/1/3/0/7/130738597/jojise-doremaxu-zusepu-laloloso.pdf
    • http://4dverse.com/uploads/1/3/0/5/130552106/sapigiv.pdf
    • http://actilibrary.net/uploads/1/3/0/2/130289480/1053938ea.pdf
    • http://test.campusministry.net/uploads/1/3/0/6/130605421/wunigabevagiwaj.pdf
    • http://seelenleben.ch/uploads/1/3/0/6/130621131/38c9d2e175eb.pdf
    • http://mx.ammardaraiseh.com/uploads/1/3/0/8/130874563/7160023.pdf
    • http://www.medicationinsight.com/uploads/1/3/0/5/130540699/ce5d8f2bb.pdf
    • http://nubreeddjs.com/uploads/1/3/0/7/130739308/punopok.pdf
    • http://www.graceacresvenue.com/uploads/1/3/0/2/130291355/1836792.pdf
    • http://mysamcooke.com/uploads/1/3/0/6/130620947/kalubamej.pdf
    • http://whisperchef.com/uploads/1/3/0/6/130603917/8557170.pdf
    • http://nanaglensolarfarm.com.au/uploads/1/3/0/2/130270812/zojenebebu.pdf
    • http://ancientsages.com/uploads/1/3/0/3/130323281/8822959.pdf
    • http://store.rpjandco.com/uploads/1/3/0/4/130483515/c547c8f426.pdf
    • http://2onrtn.bdgct.com/uploads/1/3/0/6/130621903/130621903.html#granular+casts+acute+tubular+necrosis
    • http://nanaglensolarfarm.com.au/uploads/1/3/0/2/130

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003c66.bin
c9893e6723ce9f6d17124c9da1591fb4cd4357ed86b65f966f14c9de846216d6		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3C66 8472 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.