Malicious PDF — malware analysis report

Static analysis result for SHA-256 4a4d2b7e3c818105…

MALICIOUS

PDF

40.6 KB Authoring application: QPDF
MD5: 495a970e643db0d22bca9372c83308fd SHA-1: ef23be4760add18944ddc54d4c1de41c82ac7fa0 SHA-256: 4a4d2b7e3c81810500e1eab4727f115f9ee6e318a4fc3a966a686a1bdd514eb9
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF documents hosted on various domains. This behavior is indicative of a link farm designed to direct users to potentially malicious content, consistent with phishing or malware distribution campaigns. The ClamAV detection further supports its malicious classification.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://tagcliff.com/uploads/1/3/0/7/130776425/bolaliraloda.pdf
    • http://luckybookpress.org/uploads/1/3/0/7/130739876/cca6b371a783.pdf
    • http://dmnroundtable.com/uploads/1/3/0/4/130483271/rokon-wokuwafuj.pdf
    • http://prometheusmagazine.com/uploads/1/3/0/7/130739539/xofineno-tulegejibuva-tukidamixukux.pdf
    • http://meredithroadrep.com/uploads/1/3/0/4/130476732/f1d572698fa1b9.pdf
    • http://eetiklekkerwel.nl/uploads/1/3/0/2/130272254/e9c3f0b435f7e.pdf
    • http://hiperfoam.us/uploads/1/3/0/3/130323624/rajopufidiruxida.pdf
    • http://swcdmarkit.monroecoswcd.org/uploads/1/3/0/5/130540795/koripeput-tiluxaxi-nenaza.pdf
    • http://klbhomecraftersllc.com/uploads/1/3/0/7/130775269/vufejujosuzibe_kasaxepone.pdf
    • http://quietspeculation.net/uploads/1/3/0/5/130545581/zapoxojadepoga-vevadavixiremux.pdf
    • http://openparks.net/uploads/1/3/0/4/130488486/f1d485658bfc7f0.pdf
    • http://wordthings.net/uploads/1/3/0/6/130603965/zerenutovawi.pdf
    • http://www.ketamineintegration.com/uploads/1/3/0/2/130273790/newunafu.pdf
    • http://74-123-73-216.mgwnet.com/uploads/1/3/0/3/130379653/130379653.html#action+camera+sony+hdr-as50b
    • http://prometheusmagazine.com/uploads/1/3/0/7/130739539/xofineno-tulegejibu

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00004513.bin
01b464a4cb2aba2f6c1efd6deb31f46eb00077f884e8b3dc56bbdb1537abdf31		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4513 8276 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.