Malicious PDF — malware analysis report

Static analysis result for SHA-256 4631a795394aa177…

MALICIOUS

PDF

38.7 KB Authoring application: Solid Converter PDF
MD5: 3dee4214e7cae8a68d43b87b2f8c79d5 SHA-1: 7f3251fff0f940d8123924d9d99d8ca50fdfbf38 SHA-256: 4631a795394aa1774ed77089f1b5ed760bcdae7c3d70915bf36b4dfa7b7dbd2c
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1059.001 PowerShell

The PDF file exhibits a critical heuristic firing for a PDF SEO link farm, indicating a large number of external links. The embedded URLs, such as http://www.hiddenvalleytransport.com/uploads/1/3/0/5/130539416/kopewetet.pdf, are likely used to distribute malicious content or for search engine manipulation. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports its malicious nature. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.hiddenvalleytransport.com/uploads/1/3/0/5/130539416/kopewetet.pdf
    • http://www.lustfullashbar.com/uploads/1/3/0/8/130873736/roxaxusigowitelesus.pdf
    • http://allaboutprayers.com/uploads/1/3/0/3/130323672/fawurisepidujawukeru.pdf
    • http://www.bakemeisterllc.com/uploads/1/3/0/5/130588597/junegabubovoj.pdf
    • http://prairie-to-plate.com/uploads/1/3/0/7/130776763/faf2d0fba.pdf
    • http://www.theholstoncottage.com/uploads/1/3/0/6/130621677/webokinerag-piwixanoxarele-lewip-valujilajo.pdf
    • http://ametkorca.com/uploads/1/3/0/6/130604263/suviwoxilonit_vevokusogatonal_pigofa.pdf
    • http://www.desiamericanmusic.com/uploads/1/3/0/4/130483660/3849546.pdf
    • http://precisionaqua.com/uploads/1/3/0/9/130969085/e480f4c.pdf
    • http://innsandtours.com/uploads/1/3/0/6/130639321/8870176.pdf
    • http://shoptothepoint.com/uploads/1/3/0/7/130775413/xepugukuxu_lemit.pdf
    • http://portaleconomico.info/uploads/1/3/0/7/130739766/7531310.pdf
    • http://remade.info/uploads/1/3/0/7/130776401/6753881.pdf
    • http://wizdings.org/uploads/1/3/0/5/130589216/tododagin-guzagenejekijof-xoxefifotot-nosifesur.pdf
    • http://www.officeadministrationservices.co.uk/uploads/1/3/0/6/130605030/dexilozuvasuri-nobadu-devodamozipazu.pdf
    • http://www.cincodeseptiembre.com/uploads/1/3/0/2/130288551/dexoto.pdf
    • http://minyounglee8682.com/uploads/1/3/0/3/130379674/bekilibafelof.pdf
    • http://ryansjewelryshop.com/uploads/1/3/0/5/130540246/pujij.pdf
    • http://domainthename.com/uploads/1/3/0/2/130289400/kemotopolikupejo.pdf
    • http://classicgermancarsforsale.com/uploads/1/3/0/7/130775366/debinamemivepelo.pdf
    • http://cbdirect.store/uploads/1/3/0/5/130589318/gedile.pdf
    • http://luvofit.com/uploads/1/3/0/2/130272937/suzofigi.pdf
    • http://zywavelawsuit.com/uploads/1/3/0/7/130740490/keluwa-luvijeludosef-damonume.pdf
    • http://sta-66-99-58-203.ladse.org/uploads/1/3/0/7/130739839/130739839.html#distinguish+between+archaea+bacteria+and+eukarya

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003572.bin
a53740a73d44f219ac3f3f07b5df3688d7d679b6c1f380f780ad126ab5e260f7		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3572 7672 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.