Malicious PDF — malware analysis report

Static analysis result for SHA-256 4dd03a2446e9f86e…

MALICIOUS

PDF

35.3 KB Authoring application: pstoedit
MD5: 5602cefe8d1a8d41783b5ab06c41b82b SHA-1: 642f48fa7c4dc14b27504c84ab00ec9ccdfc83ba SHA-256: 4dd03a2446e9f86ec663ce1942dce4a9851e464e0f79488b173eae914d3a0311
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded URLs pointing to external PDF files across numerous domains. This behavior is indicative of a link farm or a phishing campaign designed to drive traffic to malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious classification.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.selflovesmeraldamartes.com/uploads/1/3/0/7/130740480/xiwunidafiz_lekiwu_pesopilokimalug_xadik.pdf
    • http://amazdphotography.com/uploads/1/3/0/2/130272353/diburog_pavizoz_diwofotos.pdf
    • http://vanentrepot.com/uploads/1/3/0/5/130542964/pogasexefu.pdf
    • http://www.frogdogboutique.com/uploads/1/3/0/3/130324248/megax.pdf
    • http://partuschfire.org/uploads/1/3/0/7/130776682/bodukafed.pdf
    • http://ivanprocheret.com/uploads/1/3/0/6/130605017/2357169.pdf
    • http://guemeschannelembroidery.com/uploads/1/3/0/2/130270924/silinivule_nenumelegem_jifinib.pdf
    • http://pinehill-in-the-catskills.com/uploads/1/3/0/6/130604315/kikabasixiz.pdf
    • http://mta-sts.alaskanativeheritagemonth.com/uploads/1/3/0/5/130590538/1488508.pdf
    • http://globalmacroinvestments.com/uploads/1/3/0/4/130489102/vovava.pdf
    • http://surnamesonline.com/uploads/1/3/0/3/130312969/fugusix-nifijubur-sorefudasavug.pdf
    • http://frnkjmz.com/uploads/1/3/0/6/130639641/livomozapip.pdf
    • http://bsca2016.bsca.info/uploads/1/3/0/4/130488969/c3747b63890efba.pdf
    • http://texassaddlefitter.com/uploads/1/3/0/8/130815303/7762206.pdf
    • http://caregivercoffee.com/uploads/1/3/0/6/130621979/535584.pdf
    • http://bigdsuperfoods.com/uploads/1/3/0/2/130289732/130289732.html#effects+of+poverty+on+learners+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d73.bin
7e599d8b2645bbe9c2280846bd1c168f7512d43c14f0eed6a12a9e9e5b769bc8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D73 8272 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.