Malicious PDF — malware analysis report

Static analysis result for SHA-256 59eb2681e484de2d…

MALICIOUS

PDF

36.8 KB Authoring application: Poppler-utils
MD5: 7f92b751126088cbe3749f9959cac8be SHA-1: df5b3b07dd82c1cb65662dc7b63d072d4374e3a9 SHA-256: 59eb2681e484de2d05238d5f08705e1e6be3fa75259e22807fe34a23d08e099e
128 Risk Score

Malware Insights

MITRE ATT&CK
T1204.002 Malicious Link

The PDF document contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic, which is indicative of a link farm or phishing lure. The ClamAV detection further supports its malicious nature, classifying it as Pdf.Phishing.TtraffRobotInstall. The presence of a visual download button lure reinforces the deceptive intent. The primary goal appears to be directing users to download further malicious content from the listed URLs.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://equinemassagebysue.com/uploads/1/3/0/6/130639588/9456920bc62857.pdf
    • http://casualsexchat.com/uploads/1/3/0/7/130775269/nizatu_kixeli_najunoxibo.pdf
    • http://intelista.com/uploads/1/3/0/8/130813489/2077652.pdf
    • http://brc-management.com/uploads/1/3/0/7/130740190/luzutanatere.pdf
    • http://hostmaster.aromashoppe.nl/uploads/1/3/0/7/130775424/918303fa1b7122.pdf
    • http://wc-3.com/uploads/1/3/0/6/130640071/42d8e3c6.pdf
    • http://chupacandelabra.com/uploads/1/3/0/5/130588437/fimenenonus_tesoraduki_viregobew.pdf
    • http://mikeshurig.com/uploads/1/3/0/2/130287942/90b1b84.pdf
    • http://www.monarch-hc.com/uploads/1/3/0/7/130775393/93ac6a8f9158.pdf
    • http://graceandgigglesboutique.com/uploads/1/3/0/4/130488955/de15e.pdf
    • http://johnisnaked.com/uploads/1/3/0/5/130590047/44859c8.pdf
    • http://detox2020retreat.com/uploads/1/3/0/7/130739340/5128163.pdf
    • http://jinleqipaiyouxi.br3h.com/uploads/1/3/0/4/130476423/5851828.pdf
    • http://centrecountydownsyndrome.org/uploads/1/3/0/2/130272629/vopofus-kalinizof-moxifuta.pdf
    • http://acomputerconsultant.com/uploads/1/3/0/4/130435680/bazodadetevepiwedaw.pdf
    • http://stmmlwr.org/uploads/1/3/0/7/130776823/sazobekifa.pdf
    • http://ns1.meadowsparkapts.com/uploads/1/3/0/7/130776611/tipibuvufome.pdf
    • http://esportsrisk.com/uploads/1/3/0/5/130589285/82c55d.pdf
    • http://hmmmdesign.co.uk/uploads/1/3/0/3/130379194/towetigodi.pdf
    • http://kavyar.net/uploads/1/3/0/2/130271142/dc3d14245cf7a7a.pdf
    • http://74-123-78-122.mgwnet.com/uploads/1/3/0/4/130483728/130483728.html#trueman+objective+biology+for+neet

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e69.bin
535e7ca2a2600fffe7bd877e3b1692707235dfb30855a93ea8b029475c78af15		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E69 8604 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.