Malicious PDF — malware analysis report

Static analysis result for SHA-256 51b71896548bdbd8…

MALICIOUS

PDF

24.9 KB Authoring application: pstoedit
MD5: 852fa27c7d4320b89ebc36668e69b2bf SHA-1: a348f10c485837c4ce070349757d10b88a284cb3 SHA-256: 51b71896548bdbd89141e77ad55de5aa2d9458f191faa8e1b23ee800a7057ee9
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique commonly used for SEO poisoning or to redirect users to malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious redirection intent. No scripts were extracted, and the document body was heavily obfuscated, limiting further analysis of the specific lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.strongerhealth.com.au/uploads/1/3/0/2/130289292/vasemolir.pdf
    • http://ministryofmixology.com/uploads/1/3/0/7/130776692/kifowax.pdf
    • http://www.azaniaradio.com/uploads/1/3/0/6/130603709/961625.pdf
    • http://webdisk.thogersenfamilyfarm.com/uploads/1/3/0/7/130775722/jewamosovi_puxorezi_fidufuxew.pdf
    • http://jess-cbd.com/uploads/1/3/0/6/130620924/rufuzikide_xonupikegopos_malazinasa.pdf
    • http://www.petiteprintshop.com/uploads/1/3/0/2/130289551/vogubugotijojifafoka.pdf
    • http://knitlympics.com/uploads/1/3/0/8/130874108/2f08793c8.pdf
    • http://inboundtrain.net/uploads/1/3/0/7/130739684/05fd245f73a.pdf
    • http://www.phoenixtheatreedmonds.org/uploads/1/3/0/2/130287929/fuzemajukilinu.pdf
    • http://closinggoals.com/uploads/1/3/0/6/130639173/pesedawaf.pdf
    • http://webdisk.susanrydberg.com/uploads/1/3/0/5/130542718/deziri.pdf
    • http://matureblondsolo.porncolection.com/uploads/1/3/0/3/130379183/48252.pdf
    • http://vosrl.it/uploads/1/3/0/4/130435833/9ddf001.pdf
    • http://www.joga.virtus.hu/uploads/1/3/0/7/130775279/6977512.pdf
    • http://www.lindensfresh.com/uploads/1/3/0/5/130589427/7c6de014742aa7.pdf
    • http://mynkamorris.com/uploads/1/3/0/5/130539442/xobomojujukafux.pdf
    • http://iboughtyourdotcom.com/uploads/1/3/0/8/130814921/6b3a497140d9ed.pdf
    • http://doorrush420.com/uploads/1/3/0/5/130589299/6a531242e372.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002fd2.bin
f3ada1eb40cd3ee4fc23a7db606e537e93b834603109b00227986683379a2417		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2FD2 7936 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.