Malicious PDF — malware analysis report

Static analysis result for SHA-256 57477c0851e19795…

MALICIOUS

PDF

36.1 KB Authoring application: GIMP
MD5: 3defadb6b3f32405750ccd454d5449bc SHA-1: ed23ca25660cbafaa28a9acb291b5af6ec6df538 SHA-256: 57477c0851e197951af8658707b3602f00b71df292d19ea640c4413473b0e934
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF files hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious nature of this file, suggesting it is involved in phishing or traffic redirection.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bariatricsinc.com/uploads/1/3/0/7/130775990/5882012.pdf
    • http://mathens.net/uploads/1/3/0/8/130873916/davelivavin.pdf
    • http://lubatales.com/uploads/1/3/0/6/130639449/gepikojujif_jixoviwivenep.pdf
    • http://swctv.com/uploads/1/3/0/4/130476034/3037417.pdf
    • http://sms.shelbyvillebands.com/uploads/1/3/0/3/130313253/vuwovorebinuximolav.pdf
    • http://acherrymoon.com/uploads/1/3/0/4/130435553/kumigufa-logunegag-toxexaso-dakebalet.pdf
    • http://ninja-casino.net/uploads/1/3/0/6/130604477/xukidivoluz.pdf
    • http://nightlynewsnow.com/uploads/1/3/0/5/130589385/12599db118f68c6.pdf
    • http://number12restaurant.co.uk/uploads/1/3/0/4/130488294/wifufimu.pdf
    • http://mypartneriskinky.com/uploads/1/3/0/7/130739852/be73ebf41846.pdf
    • http://rorosglassartandcrystalskulls.com/uploads/1/3/0/8/130813765/c56dc9a793dfe.pdf
    • http://apacint.com.au/uploads/1/3/0/4/130435594/magodarizib.pdf
    • http://jakeencinas.com/uploads/1/3/0/3/130323516/wikuvumadasu-serarigo-buvakevemot-giwegulobulew.pdf
    • http://nati-artist.com/uploads/1/3/0/6/130605452/1856523.pdf
    • http://mountainpinestreetreachprogram.com/uploads/1/3/0/6/130639400/xojatugone.pdf
    • http://ridehailing.com/uploads/1/3/0/6/130620370/tukuzo.pdf
    • http://openpaw.net/uploads/1/3/0/2/130272232/gebunifix_vowovisomig_pajil.pdf
    • http://modafinilaustralia.shop/uploads/1/3/0/6/130639842/b16eac2.pdf
    • http://wwdestinations.com/uploads/1/3/0/6/130640048/130640048.html#reduce+pdf+size+adobe+reader+online

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002f5d.bin
94a67b67f897b9366522ee7f3e0d69d76c7e007e4639cc3d4eb1bbad6839419a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2F5D 7928 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.