Malicious PDF — malware analysis report

Static analysis result for SHA-256 7cea82ae4c857480…

MALICIOUS

PDF

37.9 KB Authoring application: Soda PDF
MD5: 71a12b5f1f08a77f79d0b530bd7d1963 SHA-1: 49997ea1435d7c55fd9918025eca949a0e894d26 SHA-256: 7cea82ae4c85748045e972a2cfdaadabcf6b3518033dfadb01188bc088c9506a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF documents. This is indicative of a link farm or a method to distribute malicious content across multiple domains. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-driving intent. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sococreole.com/uploads/1/3/0/2/130289341/949203.pdf
    • http://www.sunglomobile.net/uploads/1/3/0/6/130621156/kegowanumoxuve_rigopokov_nevexubetotiro_dokawoxu.pdf
    • http://reshapingyou.com/uploads/1/3/0/7/130739836/1761596.pdf
    • http://deck-hands.com/uploads/1/3/0/2/130289467/kevurinadako.pdf
    • http://sovereignbirth.com/uploads/1/3/0/5/130539990/5860236.pdf
    • http://ppc-rainmaker.com/uploads/1/3/0/8/130815031/4d19ecbbe8a.pdf
    • http://fuckdonalddrumpf.com/uploads/1/3/0/5/130540281/tuwofujixosamo.pdf
    • http://deannalindstrom.com/uploads/1/3/0/4/130488530/zudobepopofopezis.pdf
    • http://brickalation.com.au/uploads/1/3/0/6/130604962/tefigolejiz.pdf
    • http://northenddeli.com/uploads/1/3/0/6/130639334/jibogidulo.pdf
    • http://tarletonpanhellenic.com/uploads/1/3/0/9/130969989/23634.pdf
    • http://azhealthcomm.com/uploads/1/3/0/6/130604576/wevijogewuxabetu.pdf
    • http://jokerlovesharleyquinn.com/uploads/1/3/0/2/130289237/duxemovijujaxalivu.pdf
    • http://dimeperhead.com/uploads/1/3/0/7/130738876/01d8782.pdf
    • http://paulushookcafe.com/uploads/1/3/0/4/130488604/dikoroj.pdf
    • http://deputygeek.com/uploads/1/3/0/8/130813732/5662519.pdf
    • http://openmindsholistichealingcenter.com/uploads/1/3/0/6/130604923/zibaroxisez.pdf
    • http://www.musiciansangelnetwork.org/uploads/1/3/0/6/130639892/5989225.pdf
    • http://bigwalkies.com/uploads/1/3/0/6/130621819/kesagilesov.pdf
    • http://autodiscover.hiltonheadbtar122.com/uploads/1/3/0/5/130590548/4345077.pdf
    • http://tailormadedental.com/uploads/1/3/0/5/130551517/8231315.pdf
    • http://madelynarthur.com/uploads/1/3/0/7/130775195/kajanigelaf.pdf
    • http://3ljmr.bpmtc.com/uploads/1/3/0/2/130273791/130273791.html#grand+theft+auto+5+money+cheats+xbox+one
    • http://openmindsholistichealingcenter.com/uploads/1/3/0/6/130604923/zibaroxisez.pd

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003355.bin
a4d214121ed96a3b9f369e0f16b0f23ed942f74cdeeeabd8ded8823c9744a091		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3355 7768 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.