Malicious PDF — malware analysis report

Static analysis result for SHA-256 462eeea12015a171…

MALICIOUS

PDF

36.7 KB Authoring application: PDF Studio
MD5: 2ad237af6e42a967428713913f395490 SHA-1: 7f01a4fbc3313a0c7fd1438763385ec88aab0c64 SHA-256: 462eeea12015a171b441e168d86cda409ef6c63b5cc4fe3ba6972f01f4dafeee
162 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified as a link farm, and is flagged as a classic advance-fee fraud document. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports its malicious nature. The embedded URLs likely lead to further phishing content or malware downloads.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Advance-fee lottery/parcel scam lure high SE_ADVANCE_FEE_SCAM_LURE
    Document contains lottery/beneficiary or prize language together with large-value draft/funds wording and parcel/courier delivery requirements. This is a classic advance-fee fraud document shape.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bourbonhome.com/uploads/1/3/0/3/130324075/somofa-vavenakuzasadi.pdf
    • http://northwestpetsupplies.com/uploads/1/3/0/5/130588856/44cbe439d.pdf
    • http://theinnonsilverlake.com/uploads/1/3/0/5/130551057/mewewan.pdf
    • http://thepuppysocial.com/uploads/1/3/0/4/130483856/vunab.pdf
    • http://www.thisweeksbestdeals.co.uk/uploads/1/3/0/5/130590154/jasevufir.pdf
    • http://thankorchange.org/uploads/1/3/0/5/130588164/resepodosebaxukijij.pdf
    • http://sunnysidekids.com/uploads/1/3/0/7/130739664/790946.pdf
    • http://mrsjdodds.com/uploads/1/3/0/6/130639298/ropufesakinunotuf.pdf
    • http://jkjlawnsprinkler.com/uploads/1/3/0/2/130270849/3742886.pdf
    • http://kamilasbeautyroom.com/uploads/1/3/0/7/130738997/2406987.pdf
    • http://matthewgordonphotos.net/uploads/1/3/0/6/130620366/pivafusibuket.pdf
    • http://www.jubileeandthestinkyfish.com/uploads/1/3/0/5/130590310/7299726.pdf
    • http://urbannations.info/uploads/1/3/0/4/130475994/0a7af1dc80e93d.pdf
    • http://upstatephotography.org/uploads/1/3/0/6/130604288/5839474.pdf
    • http://solvemytechproblem.com/uploads/1/3/0/6/130639397/bibulozixotijij.pdf
    • http://megadethslot.com/uploads/1/3/0/3/130379299/paperobovunojaz-potutemefuzitiw-tafogazak.pdf
    • http://washingtondealerships.com/uploads/1/3/0/5/130539554/tapaluvelodid_zobufezi_kolilirarujimul.pdf
    • http://x0169003xstreamtravel.xsideas.com/uploads/1/3/0/7/130776449/130776449.html#algorithms+%284th+edition%29+by+robert+sedgewick+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000328e.bin
85bd83f9aceffd6ad45825383845a949188986fba60cee8faacda646420d563b		 pdf-font-stream PDF embedded font (sfnt) at offset 0x328E 7912 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.