Malicious PDF — malware analysis report

Static analysis result for SHA-256 45cc79e686ab424d…

MALICIOUS

PDF

39.8 KB Authoring application: Pdftk
MD5: 55e987d821e34b6eeee37877d41c82ad SHA-1: 9c457d3a00e01b7b2baddde513594d61f017931a SHA-256: 45cc79e686ab424d40c1e126274124c59a79511213fc16cf1cff134c04a9363a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious distribution intent. The document body text is heavily corrupted and does not provide additional context.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ginositalianbakery.com/uploads/1/3/0/6/130640021/mawazupifi.pdf
    • http://dogncatdentistry.com/uploads/1/3/0/6/130620449/9956753.pdf
    • http://mystgeorgesrugby.com/uploads/1/3/0/3/130379222/ferije.pdf
    • http://healthydessertscatering.com/uploads/1/3/0/5/130588603/zuzub.pdf
    • http://www.mwwrenovations.net/uploads/1/3/0/6/130605149/wuruwoguwup.pdf
    • http://shannanstanciuforschoolboard.com/uploads/1/3/0/5/130543418/vubamofaxerowolul.pdf
    • http://mta-sts.quakershaaglanden.org/uploads/1/3/0/4/130488891/508534.pdf
    • http://taylorjsmithportfolio.com/uploads/1/3/0/2/130289409/xaxukapereraro-mobewejijiz-befisajaduw.pdf
    • http://beginningphpandmysql.com/uploads/1/3/0/8/130813658/73bc2.pdf
    • http://mrsmeltabargersclass.com/uploads/1/3/0/6/130604090/kanoduvevo-desudebo.pdf
    • http://orbitfiction.net/uploads/1/3/0/6/130604798/90160b7859180.pdf
    • http://helpmedomore.com/uploads/1/3/0/7/130775405/2d4905fa.pdf
    • http://horizonlineatelier.com/uploads/1/3/0/7/130739712/nivotogitax_pobik.pdf
    • http://cateringservicessc.com/uploads/1/3/0/3/130379336/f4af4acd4d5.pdf
    • http://loudfitness1.com/uploads/1/3/0/3/130313632/261743614a.pdf
    • http://solit.studio/uploads/1/3/0/7/130776749/9434968.pdf
    • http://miloandmonroeboutique.com/uploads/1/3/0/7/130739443/7032560.pdf
    • http://suekodress.com/uploads/1/3/0/6/130605179/wozupatogorezew.pdf
    • http://rogersbellappleiphonereadreceiptssamsung.com/uploads/1/3/0/2/130272094/7cfd22de5d94e.pdf
    • http://rcrlogistics.net/uploads/1/3/0/7/130775339/379f6f6e1.pdf
    • http://hostmaster.4140designs.com/uploads/1/3/0/5/130589033/130589033.html#visualvm+not+showing+mbeans

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000038e9.bin
8aeb9df8bd93c4cc056ac4dd9da613e859c1666edbf2ef099766842516bdc41c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x38E9 8920 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.