Malicious PDF — malware analysis report

Static analysis result for SHA-256 5260f70b8c967a2f…

MALICIOUS

PDF

32.0 KB Authoring application: Solid Converter PDF
MD5: c1a92de6bb046bc4ae9fd436f15731f3 SHA-1: 9ea5848a47d8c804dee238229d44ca13c9308188 SHA-256: 5260f70b8c967a2fca85ab903902058cbd81609c414cb96aa223d32b54605a28
128 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious File T1566.002 Spearphishing Attachment

The PDF file contains a mass external link farm, with 30 links pointing to other PDF files hosted on various domains. This is indicative of a SEO poisoning or phishing campaign. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a malicious classification. The document body, though heavily obfuscated, mentions 'Achievers a1 workbook' and 'Download', suggesting a lure to download potentially malicious content.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.cfaeconthemoove.com/uploads/1/3/0/5/130588251/kugugado.pdf
    • http://bladescommerciallawncare.com/uploads/1/3/0/6/130605399/4850285.pdf
    • http://organik-zeytinyaglari.com/uploads/1/3/0/6/130640181/5394095.pdf
    • http://cpanel.shaktibliss.com.au/uploads/1/3/0/7/130776031/5367073.pdf
    • http://www.ewalondon.com/uploads/1/3/0/7/130738739/5724618.pdf
    • http://crtropicallivethedream.com/uploads/1/3/0/6/130621746/af334a0.pdf
    • http://scrubs2love.org/uploads/1/3/0/5/130590123/933469.pdf
    • http://visionsciencestudios.com/uploads/1/3/0/2/130289558/8586944.pdf
    • http://iamcnola.org/uploads/1/3/0/6/130620667/edc5b54cbe66bf.pdf
    • http://wvcdigitalmarketingcoach.com/uploads/1/3/0/7/130739032/zabetufufuli.pdf
    • http://ngundua.info/uploads/1/3/0/7/130776659/feran.pdf
    • http://cornwall2theandes.com/uploads/1/3/0/6/130622007/kuzoset.pdf
    • http://www.isabelladavidvintage.com/uploads/1/3/0/5/130550953/4037294.pdf
    • http://pixelfin.net/uploads/1/3/0/5/130588457/pugugu.pdf
    • http://blackbusinessexpo1.com/uploads/1/3/0/5/130542968/lolibufu_tavagolapo_rowirafadakodef_vesavonura.pdf
    • http://74-123-76-197.mgwnet.com/uploads/1/3/0/5/130547038/130547038.html#achievers+a1++workbook

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000230f.bin
d5c5a508c8de25ea2bebdbc29cd307e26c6a8426a169c579f1423bd2de3814c1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x230F 7512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.