Malicious PDF — malware analysis report

Static analysis result for SHA-256 4c371c21fe84a14e…

MALICIOUS

PDF

55.6 KB Authoring application: GIMP
MD5: 8a6bb5b3dcfdb57da429d8f8fca97f67 SHA-1: 0b074c3f8e3ddb7ec9731e8507651540b88c18ed SHA-256: 4c371c21fe84a14e3c3357c2bd788e8104a737916b1040c63e61dcca9fdec955
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to external PDF documents. This is indicative of a link farm or redirection strategy, likely intended to host phishing content or further malware. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly supports a phishing or malicious traffic generation intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mail.bartpatrzalek.com/uploads/1/3/0/8/130813649/4ea23cc631.pdf
    • http://kolorpaints.com/uploads/1/3/0/4/130476053/f7fd6e349e.pdf
    • http://thegrampo.com/uploads/1/3/0/7/130740414/594ce6246af4cd8.pdf
    • http://traderhorn.net/uploads/1/3/0/4/130490218/9349346.pdf
    • http://societasstudiorumamdg.com/uploads/1/3/0/6/130640029/jupujanapubidexaxoli.pdf
    • http://jq-photography.com/uploads/1/3/0/5/130543050/nomumibup.pdf
    • http://robertjohnsonpainting.com/uploads/1/3/0/4/130477584/6575123.pdf
    • http://www.stacksapparelshop.com/uploads/1/3/0/6/130640031/d8f6ad496c91bd.pdf
    • http://mybenstratton.com/uploads/1/3/0/7/130776218/2683767.pdf
    • http://msestate.co.jp/uploads/1/3/0/5/130588291/9f29be61a78c.pdf
    • http://mwmorriscreative.com/uploads/1/3/0/6/130620899/romopikimoxa.pdf
    • http://dearrouge.ca/uploads/1/3/0/4/130488243/rotexojewono.pdf
    • http://celsosim.com/uploads/1/3/0/2/130270956/47837.pdf
    • http://fitrition.com.au/uploads/1/3/0/6/130604363/b3b6edc89d8c53.pdf
    • http://www.myhilocollection.com/uploads/1/3/0/3/130313567/vudonixewigevut.pdf
    • http://chinawindow.biz/uploads/1/3/0/6/130639272/7526786.pdf
    • http://www.caitweiss.com/uploads/1/3/0/8/130814066/398f69.pdf
    • http://thefriendlybird.com/uploads/1/3/0/5/130550781/lowavifesupuz-wagexewo-mulid.pdf
    • http://sweetmaplecafe.co/uploads/1/3/0/5/130539678/laxemetoxegizuzilita.pdf
    • http://nkathleen.com/uploads/1/3/0/7/130740054/jiwexoxupeje.pdf
    • http://y3yq7.bpmtc.com/uploads/1/3/0/5/130590672/130590672.html#naphthaleneacetic+acid+%28naa%29+solution

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000104a.bin
8236f696a8597eba6be429058761ff01fdef1d1618038dbc4c9123506b641611		 pdf-font-stream PDF embedded font (sfnt) at offset 0x104A 9436 bytes
font_01_sfnt_off00008dca.bin
c048ac4ed90d63bfae46472f65f9cf6fc0bd5e75369f2d8f28771a6d96a2731c		 pdf-font-stream PDF embedded font (sfnt) at offset 0x8DCA 3156 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.