Malicious PDF — malware analysis report

Static analysis result for SHA-256 56b25793519d949d…

MALICIOUS

PDF

36.1 KB Authoring application: Solid Converter PDF
MD5: 8c51950b2747e7e1cee34dae2eb91799 SHA-1: 92f1130e2ee36364f6addf81331f1fdada5e4c0e SHA-256: 56b25793519d949d59d9918d1127e5f590defce664c5a7a62b171c4cbc6711f1
120 Risk Score

Malware Insights

MITRE ATT&CK
T1059.001 PowerShell

The PDF file exhibits characteristics of a phishing or SEO spam campaign, as indicated by the 'PDF_SEO_LINK_FARM' heuristic firing. It contains a large number of embedded URLs pointing to external PDF files, suggesting an attempt to distribute malicious content or manipulate search engine results. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious classification. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mta-sts.kelvingibbons.com/uploads/1/3/0/6/130620154/zibumukoraxegurisato.pdf
    • http://componentcatalog.dev/uploads/1/3/0/4/130435516/kewipe_zilamof.pdf
    • http://andyzeffer.com/uploads/1/3/0/5/130546244/dejofir-diman-jajenofebina-puvekubipiti.pdf
    • http://citizeminds.org/uploads/1/3/0/9/130969003/vodujelupip.pdf
    • http://austbrokerscentralcoast.com/uploads/1/3/0/4/130436121/2280590.pdf
    • http://myhippybohemianhome.com/uploads/1/3/0/6/130604658/mejavilorolig.pdf
    • http://vagascuritiba.net/uploads/1/3/0/2/130270833/jobubogov.pdf
    • http://balanceergo.com/uploads/1/3/0/2/130289569/a99a57554.pdf
    • http://www.untappedresources.biz/uploads/1/3/0/5/130539243/5475780.pdf
    • http://premiumdealsclub.com/uploads/1/3/0/6/130639895/kogodasisebavas.pdf
    • http://theawesomeguide.com/uploads/1/3/0/6/130620222/tudanulononusove.pdf
    • http://8change.org/uploads/1/3/0/7/130739309/5436290.pdf
    • http://jwmayfield.net/uploads/1/3/0/5/130588928/2641743.pdf
    • http://gracecartercapstone.com/uploads/1/3/0/6/130604869/130604869.html#letras+do+alfabeto+para+imprimir+e+recortar+tamanho+medio

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003192.bin
ce69c0ff67bddfaa768a51b790e83286971d6227ec8d8e6ed2e324f8f7079d36		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3192 10344 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.