Malicious PDF — malware analysis report

Static analysis result for SHA-256 780668251daa3cbc…

MALICIOUS

PDF

39.6 KB Authoring application: Smallpdf Desktop
MD5: 3beded00571804020af6f72fb00aa82d SHA-1: 5d799c840231d87678a8c3495a817ae64d981228 SHA-256: 780668251daa3cbcbe684b16551d8be4416b992a4bbd0f7dfabd34028f205e72
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains a large number of embedded URLs pointing to external PDF documents. This behavior is indicative of a link farm or SEO manipulation tactic, often used to distribute malicious content or phishing lures. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection intent. No scripts were extracted from this sample, limiting the ability to determine specific payload delivery mechanisms.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://savvynotary.com/uploads/1/3/0/5/130540010/db477eb6177630.pdf
    • http://kylewidner.com/uploads/1/3/0/2/130273791/0f3feba17.pdf
    • http://robinreitzes.com/uploads/1/3/0/7/130775682/7724755.pdf
    • http://thisweeksbestdeals.com/uploads/1/3/0/4/130475964/bcb519.pdf
    • http://duilawvt.net/uploads/1/3/0/7/130739782/xiwizomifuzumufukufi.pdf
    • http://conqueracademy.com/uploads/1/3/0/5/130551054/f2030c46fe0f.pdf
    • http://hostmaster.gdub.tv/uploads/1/3/0/6/130605383/mipusetanuv.pdf
    • http://nicolas-rigaux-photographe.com/uploads/1/3/0/4/130489727/2728059.pdf
    • http://kjerstikveli.net/uploads/1/3/0/6/130604951/2592907.pdf
    • http://richmondfutsal.com/uploads/1/3/0/6/130603913/vutavupa-duwavavovamem-nalegilezew-kevetabofixo.pdf
    • http://commandlineidiot.com/uploads/1/3/0/6/130620788/9822927.pdf
    • http://rrrtag.com/uploads/1/3/0/2/130287527/xutelinuwuxe-pagon-gojegaxi.pdf
    • http://justgreatcareers.com/uploads/1/3/0/3/130380002/6b72160db43.pdf
    • http://queenbeenails.net/uploads/1/3/0/5/130543065/aa60b62ee1ccc4.pdf
    • http://mrsottocounselingcorner.com/uploads/1/3/0/4/130483638/be295db8dd.pdf
    • http://mixlegacy.com/uploads/1/3/0/4/130476320/cae6d0e042.pdf
    • http://a.marisths.org/uploads/1/3/0/7/130739618/porojonilumel.pdf
    • http://heeratees.com/uploads/1/3/0/7/130775429/duxaborurowe_suxar_dojiruzebi_bajuruja.pdf
    • http://twinitron.com/uploads/1/3/0/6/130639990/9866388.pdf
    • http://designguard.us/uploads/1/3/0/5/130544468/tebutaz.pdf
    • http://loneymetalworks.com/uploads/1/3/0/3/130379285/ruruni_donupunow.pdf
    • http://mynaturalhairspa.com/uploads/1/3/0/3/130323163/5434449.pdf
    • http://bandgphotography.info/uploads/1/3/0/7/130738684/sorel.pdf
    • http://sewbusy.net/uploads/1/3/0/7/130739147/fixodowijik.pdf
    • http://tangball-online.lucky1st.com/uploads/1/3/0/4/130435850/130435850.html#apache+airflow+vs+jenkins

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003980.bin
ee21851bc9f3dfd2a26cf76e15a453fa83ec7bed38b4c7b73b15064afd2d5dc5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3980 7304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.