Malicious PDF — malware analysis report

Static analysis result for SHA-256 7da4e91f3105a012…

MALICIOUS

PDF

45.7 KB Authoring application: PDF Studio
MD5: 569a304030142e0c3efea054f8b8ccb1 SHA-1: 6a5d81eb1a544d7123ae491f83a5a40dad87014d SHA-256: 7da4e91f3105a012e3e9abb22fc895970cb7339945c1084ad3a7ef8a1704f16f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall-7605656-0 further supports a malicious intent. The primary goal appears to be directing users to a vast array of external PDF documents hosted on numerous domains, likely for SEO spam or phishing purposes.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mta-sts.mail.gardenclubofmorristown.org/uploads/1/3/0/8/130814597/gedivesofizowi.pdf
    • http://phonic88.com/uploads/1/3/0/5/130539645/2677464.pdf
    • http://modicash.nl/uploads/1/3/0/6/130620326/bojudokagekiw-burifazagifina-fidasopiked-sotufa.pdf
    • http://citizensreachout.org/uploads/1/3/0/6/130639351/jaduwub.pdf
    • http://maolspet262.com/uploads/1/3/0/7/130740480/62da51.pdf
    • http://oldfieldfarmhorseandhome.com/uploads/1/3/0/6/130605397/rujunofatajazun-gixavukax-rudovoje-tuxikoku.pdf
    • http://exceptionalgeeks.com/uploads/1/3/0/2/130270956/9571385.pdf
    • http://mariobellostudios.com/uploads/1/3/0/6/130605017/8339475.pdf
    • http://ndsportschannel.net/uploads/1/3/0/7/130775274/8805457.pdf
    • http://pordenone.rocks/uploads/1/3/0/8/130874623/3ac5cfb4dc24.pdf
    • http://nwrealtybrokers.com/uploads/1/3/0/6/130604675/bad52c442a.pdf
    • http://www.growingbolderfitness.com/uploads/1/3/0/2/130289338/kosozovenovixuzaribu.pdf
    • http://www.womenwritersweb.com/uploads/1/3/0/2/130287242/38412ec1716f.pdf
    • http://www.itsthehealth.com/uploads/1/3/0/4/130476412/24c28ca7.pdf
    • http://sync4.cloud/uploads/1/3/0/7/130775375/kiwagufidonezisu.pdf
    • http://www.plumeify.fr/uploads/1/3/0/7/130776420/b44f82cbb5.pdf
    • http://exitmeasure.org/uploads/1/3/0/8/130813643/magefenivevisa.pdf
    • http://www.tordareeds.co.uk/uploads/1/3/0/5/130539657/vibuf.pdf
    • http://telescope-planet.com/uploads/1/3/0/6/130604708/3066573.pdf
    • http://gearaddiction.org/uploads/1/3/0/6/130622091/figasojaguzodim-dijavi-kotijoj.pdf
    • http://rhiannonlisettehenry.com/uploads/1/3/0/3/130323593/3613126.pdf
    • http://saveayouthoc.org/uploads/1/3/0/5/130539244/1780702.pdf
    • http://mrsseamonsclass.com/uploads/1/3/0/5/130538922/3781ac92844d5.pdf
    • http://fxu14.bpmtc.com/uploads/1/3/0/4/130435884/130435884.html#boulevard+of+broken+dreams+letra+en+espa%C3%B1ol+e+ingles

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000034c1.bin
f31c439e28d0137206b91a151f21343900f846ed9ff070250fbe82eb1cc7da1d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x34C1 16204 bytes
font_01_sfnt_off00004cf8.bin
5a7d805192157416bad77931aa6fc6be61b276647581e5570e73706a854c97f9		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4CF8 9408 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.