Malicious PDF — malware analysis report

Static analysis result for SHA-256 46fa762ae0748792…

MALICIOUS

PDF

37.6 KB Authoring application: Mobipocket Creator
MD5: 43d12b5596730b44235424c82e75ac6b SHA-1: 53e690ec20e448b5514961090cb974202e83d46e SHA-256: 46fa762ae0748792f5d8790166250c09fb9918bdb4582102592ee7b1b2e40e31
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique often used for SEO manipulation or to redirect users to phishing or malware distribution sites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious intent. The embedded URLs are the primary indicators of compromise, suggesting a redirection-based attack.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dorzasdrivingschool.com/uploads/1/3/0/3/130379172/xafowed-xudopo-genazudumupo.pdf
    • http://nakedbl0ndeee.com/uploads/1/3/0/7/130739392/minuxova.pdf
    • http://mgmalehair.com/uploads/1/3/0/4/130476830/xosuf.pdf
    • http://www.randmc2019.com/uploads/1/3/0/3/130379163/vunemom.pdf
    • http://recallcathy.com/uploads/1/3/0/7/130738497/57d5983886253.pdf
    • http://magicandmystic.com/uploads/1/3/0/2/130271017/dodipojomug.pdf
    • http://www.caramelosweetshop.co.uk/uploads/1/3/0/5/130551126/dedugib.pdf
    • http://www.storetech.org/uploads/1/3/0/4/130476575/wewifi.pdf
    • http://ryanmecheski.com/uploads/1/3/0/2/130289209/7625838.pdf
    • http://jhonblack.net/uploads/1/3/0/2/130287527/9166373.pdf
    • http://dallasairductcleaning.net/uploads/1/3/0/7/130739615/monexejefoditamugit.pdf
    • http://countingwithelliot.com/uploads/1/3/0/6/130639240/wurakukimutoje.pdf
    • http://iamjeffsmith.com/uploads/1/3/0/5/130546645/6b71eebf0a09a8.pdf
    • http://sendsomehappymail.com/uploads/1/3/0/6/130620567/funab.pdf
    • http://access2offshore.com/uploads/1/3/0/6/130604077/nemirapixuxubofizula.pdf
    • http://fivethirteenfree.com/uploads/1/3/0/4/130489175/gidasegukawamo_kusaxenutipogux_vibuvamo.pdf
    • http://kayleighpeddie.com/uploads/1/3/0/6/130604407/69ecedf1ef.pdf
    • http://youngmindsfreshideas.com/uploads/1/3/0/4/130475955/9526224.pdf
    • http://birthhealing.com/uploads/1/3/0/8/130874012/zawokinol_virike_tijesafuk_fidote.pdf
    • http://bokobowls.com/uploads/1/3/0/6/130620492/57c1b48c5859.pdf
    • http://thaddeusnhizfamily.com/uploads/1/3/0/6/130621244/nituxag.pdf
    • http://mountshastamassage.com/uploads/1/3/0/6/130622048/xusudiv.pdf
    • http://eg45a.bpmtc.com/uploads/1/3/0/7/130776791/130776791.html#idiopathic+thrombocytopenic+purpura+%28itp%29

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003384.bin
cabc7c24f0a85dd55ab96bc026ef6ccfa3c26f993aa76df3c002802279d6c37c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3384 7168 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.