Malicious PDF — malware analysis report

Static analysis result for SHA-256 54af9e7cf11fd27a…

MALICIOUS

PDF

40.3 KB Authoring application: Mobipocket Creator
MD5: 9351f057424207514076d3b8e680a85a SHA-1: e0f5cdd741abfcd17382e2cfae5d7d899c805103 SHA-256: 54af9e7cf11fd27ad07b494fa3e9f289c0cfbae8ca74220fc5dce69840b3d4a2
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links, identified by the PDF_SEO_LINK_FARM heuristic, pointing to external PDF files. This suggests a tactic to manipulate search engine results or to distribute further malicious content. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent, likely related to phishing or traffic redirection.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://khmajyanalwaldik.com/uploads/1/3/0/6/130604150/xalafozi_zazemokuko_biwamipalekel.pdf
    • http://roilights.com/uploads/1/3/0/3/130379123/kivafojasatigaz-zedokogakadi-vofowe-samukap.pdf
    • http://missoulaimports.com/uploads/1/3/0/3/130313632/mesetivesikax-lipejamubuxamal-zolitoxoti.pdf
    • http://serenityrowe.com/uploads/1/3/0/6/130620279/nolelikebewovos-fomasipagasa-mejarokas-dadiminox.pdf
    • http://webmail.iinsitu.com/uploads/1/3/0/2/130272906/130001.pdf
    • http://balihaidreams.com/uploads/1/3/0/4/130478609/nexuvelafo_basunopimefote_bofoki_pexevale.pdf
    • http://like-pi.net/uploads/1/3/0/5/130589452/dowurimom.pdf
    • http://nrvikingspiritwear.com/uploads/1/3/0/4/130476541/f209c9d8e82f600.pdf
    • http://multiiverse.com/uploads/1/3/0/5/130550832/1108178.pdf
    • http://rollatropicalsno.com/uploads/1/3/0/7/130775560/topagugajos.pdf
    • http://mx.montmarin.org/uploads/1/3/0/8/130873824/pavavanuwa-tisalajuvuliri.pdf
    • http://modvintiqueinteriors.com/uploads/1/3/0/7/130738841/kavumasogesojev-nixali-vuduwujimo.pdf
    • http://valcom.tv/uploads/1/3/0/2/130289310/kusejakotela-febukorel.pdf
    • http://singleparentcounsel.com/uploads/1/3/0/7/130739073/9275e7a6.pdf
    • http://www.pikalevi.net/uploads/1/3/0/9/130969679/lovekezalepakov.pdf
    • http://tulipsandroses.photography/uploads/1/3/0/2/130272232/lodejipukek_wazibuzifotoda.pdf
    • http://newportplant.com/uploads/1/3/0/5/130589431/lipiw_libago_kumipewe.pdf
    • http://artofitness.com/uploads/1/3/0/2/130289692/nefupowekonod.pdf
    • http://genmakers.com/uploads/1/3/0/2/130291585/zejawonasokadef.pdf
    • http://independentadultcarehomeassociation.com/uploads/1/3/0/5/130543353/5464244.pdf
    • http://minestarters.net/uploads/1/3/0/7/130738950/9495565.pdf
    • http://birdislandplacenciabz.com/uploads/1/3/0/5/130590503/7723447.pdf
    • http://blinebeachbar.com/uploads/1/3/0/4/130490602/jixirobokot.pdf
    • http://tipsytacocantina.com/uploads/1/3/0/3/130379363/2104350.pdf
    • http://befreetherapy.com/uploads/1/3/0/7/130740492/130740492.html#writing+task+1+criteria+ielts
    • http://missoulaimports.com/uploads/1/3/0/3/130313632/mesetivesikax-lipejamubuxamal-zolito

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000038d7.bin
aa937e27fd7dad455a14235669fecf9d81130e1191208b33bc20502a5c1fe318		 pdf-font-stream PDF embedded font (sfnt) at offset 0x38D7 8216 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.