Malicious PDF — malware analysis report

Static analysis result for SHA-256 552613d0ecee0eed…

MALICIOUS

PDF

44.3 KB Authoring application: Solid Converter PDF
MD5: 838fa62a1dd82b0e34b3f8f55053b63b SHA-1: 6e4e827e0b8f7f432c0b1e5c6aa6b6037d07db55 SHA-256: 552613d0ecee0eed5938fffc98b641b7f30444d102584bcea12aa2c52a3d0106
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique often used for SEO poisoning or to redirect users to phishing or malware distribution sites. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample, and the document body was heavily truncated, limiting further analysis of the specific lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://barebeautypdx.com/uploads/1/3/0/7/130738528/samupidozawuwosoxu.pdf
    • http://odessahomeinspection.com/uploads/1/3/0/8/130813577/4dbc9394e9.pdf
    • http://clevelandtoybox.com/uploads/1/3/0/6/130639910/7533219.pdf
    • http://timurmustafin.com/uploads/1/3/0/6/130639215/pisos-fagasixu-sazure.pdf
    • http://doorrush420.com/uploads/1/3/0/5/130543538/simijevikazogejare.pdf
    • http://straindesign.com/uploads/1/3/0/6/130639133/sojifazoxigivow.pdf
    • http://temperamentsart.com/uploads/1/3/0/3/130379070/504413.pdf
    • http://topplab.org/uploads/1/3/0/2/130273791/giwade-zagunogolu.pdf
    • http://alinacruzfengshui.com/uploads/1/3/0/8/130873740/nakixuxes.pdf
    • http://puppettearspod.com/uploads/1/3/0/5/130588206/namuki.pdf
    • http://djprince.info/uploads/1/3/0/6/130621335/5886023.pdf
    • http://goldpricestoday.org/uploads/1/3/0/4/130435524/5714160.pdf
    • http://www.freshouttaasia.com/uploads/1/3/0/2/130289332/5d51c22ae15.pdf
    • http://nfldraftdays.com/uploads/1/3/0/6/130639836/389310.pdf
    • http://waltzerbooth.com/uploads/1/3/0/7/130739719/8910120.pdf
    • http://ninanolan.net/uploads/1/3/0/6/130639021/78b6e903f4.pdf
    • http://kaslearning.com/uploads/1/3/0/8/130874015/499c49a8b.pdf
    • http://lijiboyulechengxianjinkaihu.f18.ebkf.org/uploads/1/3/0/4/130489604/1344798.pdf
    • http://beautybybfm.com/uploads/1/3/0/7/130775136/jetobubazipop.pdf
    • http://natureallbody4ever.com/uploads/1/3/0/5/130551423/0a681cd985af7.pdf
    • http://athomeonline.com/uploads/1/3/0/6/130620936/ziwodowawoxifokatuxi.pdf
    • http://pcfenceco.com/uploads/1/3/0/5/130541462/mabanojodinofulajeto.pdf
    • http://mrscastillo.com/uploads/1/3/0/2/130289406/zevizorola.pdf
    • http://reikijan.com/uploads/1/3/0/5/130551202/c096bac32.pdf
    • http://v9zhr.slpny.com/uploads/1/3/0/5/130588579/130588579.html#difference+between+heart+attack+cardiac+arrest+and+myocardial+infarction

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003354.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3354 16036 bytes
font_01_sfnt_off00004a6e.bin
8e9304009a568b02dc18546a1fd88de0a41088bc9b9392c6d9ff7b75f84c31e3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4A6E 7756 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.