PDF malware analysis — malicious · 574ebdfccfc53e62

MALICIOUS

PDF

42.7 KB Authoring application: Poppler-utils

MD5: 6db333d7ee01e3740f4a46be29b405ee SHA-1: 41973daff75f7e08f4144abe3c60f2b016f3833d SHA-256: 574ebdfccfc53e62730e2edf537782a017918fde3ba60a45b95bdd9c87978abb

120 Risk Score

Malware Insights

MITRE ATT&CK

T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to other PDF files on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious distribution intent. No scripts were extracted from this sample.

Heuristics 3

Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM

Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION

ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
Embedded URL info EMBEDDED_URL

One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
URL http://reliantdiversifiedservices.com/uploads/1/3/0/6/130620835/weduk_nekil_demig.pdf
- http://caitlindoula.com/uploads/1/3/0/7/130776819/minej-pevurase.pdf
- http://kinderchat123.org/uploads/1/3/0/5/130539355/7270307.pdf
- http://midwestairsoftgroup.net/uploads/1/3/0/7/130740617/2330709.pdf
- http://annasopranna.com/uploads/1/3/0/3/130324050/baludosozare.pdf
- http://upclimbconsulting.com/uploads/1/3/0/4/130483757/padilosuxesifiva.pdf
- http://movemissouri.com/uploads/1/3/0/5/130551186/petonufasodufat-vowogej-sodoluso-fedoxezalokamo.pdf
- http://crinklecon.com/uploads/1/3/0/6/130639885/gosofe.pdf
- http://www.freedomwaycapital.com/uploads/1/3/0/5/130590777/4070816.pdf
- http://cpanel.yoroshiku-japan.com/uploads/1/3/0/6/130639764/sedolivatu_zatopikivij_furona.pdf
- http://www.aidinitortellini.com/uploads/1/3/0/2/130289543/d39bf.pdf
- http://www.celsoazamarphotography.us/uploads/1/3/0/8/130874413/87af261b52f5a88.pdf
- http://alinmobiliaria.com/uploads/1/3/0/8/130814024/belepelofunuben_dazapo_mojojuburaxenod.pdf
- http://moorestrom.com/uploads/1/3/0/7/130739663/915be2.pdf
- http://effectivesite.com/uploads/1/3/0/7/130739621/kukanuwusemukimefuja.pdf
- http://mrmacbible.org/uploads/1/3/0/5/130589396/8761511.pdf
- http://colibot.com/uploads/1/3/0/5/130541950/mafenijokizafoxa.pdf
- http://cpe-65-255-244-10.legalrightscenter.org/uploads/1/3/0/7/130740622/1c0e5.pdf
- http://christinabarsi.net/uploads/1/3/0/4/130488476/fareguxedewem.pdf
- http://www.universalfederationxmotherearth.com/uploads/1/3/0/5/130545485/b35b4e9dfac39.pdf
- http://monashsoccerclub.com/uploads/1/3/0/5/130539329/xazazebaki.pdf
- http://www.simpleebowtique.com/uploads/1/3/0/6/130604466/351773.pdf
- http://alisonharperbeauty.com/uploads/1/3/0/8/130813042/senawoxoma-wopas-lozewakeva.pdf
- http://adsl-63-204-18-31.benefitplans.org/uploads/1/3/0/8/130814382/130814382.html#british+thoracic+society+acute+asthma+guidelines
- http://www.celsoaza

Extracted artifacts 2

Files carved from inside the sample during analysis.

Filename	Kind	Source	Size
`font_00_sfnt_off000034a3.bin` `4e9ae17c41f053e7ad2cff4c16f4465db96732130fdde230725ded2fe80853ad`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x34A3	3156 bytes
`font_01_sfnt_off00004239.bin` `8c061260ffe9e4765991fc46346519edb086aa0fefeca714a5d3c0c8925efd7c`	pdf-font-stream	PDF embedded font (sfnt) at offset 0x4239	8516 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.