Malicious PDF — malware analysis report

Static analysis result for SHA-256 586bca84d151075e…

MALICIOUS

PDF

38.3 KB Authoring application: Adobe PDF Library 9.0
MD5: b5ce5b028405881a9548a9000f25ec39 SHA-1: df05851e981300a97c08ddf1fc1f1380136adc1d SHA-256: 586bca84d151075e90249783404d3ac4b6b4508b0f6586bd216b75ab616dd014
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to other PDF files, indicating a link farm designed for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing or traffic redirection scheme. The presence of a visual download button further supports the lure-based attack pattern.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://wildcardwalks.com/uploads/1/3/0/7/130739362/zawojoganoxo.pdf
    • http://thebateyshop.com/uploads/1/3/0/6/130639882/geruvuru-fuvifigogokipes.pdf
    • http://yourrussianrivertownhouse.com/uploads/1/3/0/4/130435745/movefanonotufa.pdf
    • http://replicontainer.com/uploads/1/3/0/6/130621815/xulawosisegiwimal.pdf
    • http://mercyministrystl.org/uploads/1/3/0/4/130489122/tuvoginugefoz.pdf
    • http://knutsonconsulting.com/uploads/1/3/0/4/130435635/9639742.pdf
    • http://nybestdentist.net/uploads/1/3/0/8/130814967/tavowexon-mavozivefike-fader.pdf
    • http://jamesagibson.com/uploads/1/3/0/6/130604421/6546cb.pdf
    • http://apexafterschool.com/uploads/1/3/0/3/130379319/ef938f17715e026.pdf
    • http://pepay.host/uploads/1/3/0/5/130588809/7225483.pdf
    • http://parentingtoolkitforfamilies.com/uploads/1/3/0/5/130540461/wonerusazudo_sipukelafetavok.pdf
    • http://kahunayoga.com/uploads/1/3/0/4/130489343/lakome.pdf
    • http://www.videosmash.me/uploads/1/3/0/5/130588584/263c9d140.pdf
    • http://mx.wearethelightoftheworld.com/uploads/1/3/0/5/130589315/df28187f.pdf
    • http://www.t2aerospace.com/uploads/1/3/0/2/130287835/8395895.pdf
    • http://www.foundationalparenting.org/uploads/1/3/0/6/130604876/leradetovupon.pdf
    • http://nymantechnologies.net/uploads/1/3/0/8/130814785/vufobazidone.pdf
    • http://zaster.co.uk/uploads/1/3/0/2/130288383/lidajuto.pdf
    • http://ginettelaw.com/uploads/1/3/0/4/130483279/585650.pdf
    • http://batterycfosummit.com/uploads/1/3/0/3/130323538/kitevasap.pdf
    • http://secretofmemory.com/uploads/1/3/0/6/130604258/muboso_nuzirilisejoba.pdf
    • http://mail.studentske-listy.cz/uploads/1/3/0/2/130272903/2183562.pdf
    • http://moneytipmonday.com/uploads/1/3/0/4/130476307/xarobeg-xodemalafej.pdf
    • http://v90hr.bpmtc.com/uploads/1/3/0/6/130621450/130621450.html#filmora+9+manual+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000331d.bin
4dd4c7b69ae02e4e95b162108566614368e625ac20a536c83f0d7b553ec009fd		 pdf-font-stream PDF embedded font (sfnt) at offset 0x331D 7912 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.