Malicious PDF — malware analysis report

Static analysis result for SHA-256 83a07db01e4016f3…

MALICIOUS

PDF

94.2 KB Authoring application: Soda PDF
MD5: 6d29ef48eea8bb048f146cb4097d7062 SHA-1: 70d4569f35929f73d43770540fc7369f86821430 SHA-256: 83a07db01e4016f350182cf1a6e18b79af106a8c500139851114a3d88915bedf
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1059.001 PowerShell

The PDF file contains an embedded JavaScript stream and a large number of external links to other PDF files hosted across various domains. This behavior is indicative of a link farm or redirection scheme, likely intended to lead users to malicious content or phishing pages. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic-generation intent.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded JS stream low PDF_JS
    PDF references a /JS stream. Generic JavaScript is common in benign forms; specific dangerous APIs are scored by separate rules.
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://nextbuildingforum.com/uploads/1/3/0/5/130547728/3646521.pdf
    • http://swat1806.com/uploads/1/3/0/6/130639273/6035150.pdf
    • http://www.jakehandelman.com/uploads/1/3/0/7/130775354/boviweg.pdf
    • http://cisna.org/uploads/1/3/0/3/130379769/5710019.pdf
    • http://thedjkurx.com/uploads/1/3/0/6/130621200/zasifegetepif.pdf
    • http://zjliu.org/uploads/1/3/0/2/130274330/387dfb.pdf
    • http://mypartypro.net/uploads/1/3/0/6/130621095/lokijizepelibe-kalivizaweboxim.pdf
    • http://paddlebp.com/uploads/1/3/0/5/130543207/dbcc3a.pdf
    • http://paulsfavoritestuff.com/uploads/1/3/0/8/130814065/xenajod-xatudofami-gugegijoz-duzere.pdf
    • http://koawarriors.com/uploads/1/3/0/5/130550944/gakeramitositi.pdf
    • http://swoapy.com/uploads/1/3/0/6/130621394/sowerowonovafumor.pdf
    • http://live4inspiration.com/uploads/1/3/0/4/130483550/592914.pdf
    • http://rscrystalmedicine.com/uploads/1/3/0/5/130551202/5775633.pdf
    • http://percorsidarte.com/uploads/1/3/0/3/130313585/kinusejage_warifipum_lazonujulof_pepomi.pdf
    • http://thesortexfortress.com/uploads/1/3/0/7/130740068/c5d6484918bd61.pdf
    • http://reenchant.com/uploads/1/3/0/5/130544725/1123554.pdf
    • http://sefpay.com/uploads/1/3/0/2/130272266/rosigipesawodi-vibuvevodaj-rurut.pdf
    • http://www.makeartsforabetterlife.org/uploads/1/3/0/4/130483396/dadekawezadasoxufig.pdf
    • http://lasvegasquicklane.com/uploads/1/3/0/3/130323656/fesuwivumura.pdf
    • http://testchangelawyers.org/uploads/1/3/0/8/130813357/0305e515ccafe71.pdf
    • http://u-ehs.com/uploads/1/3/0/4/130477533/5593372.pdf
    • http://www.spencercasephilosophy.com/uploads/1/3/0/6/130639017/d8321.pdf
    • http://magnoliastravelandtouradventures.voyagerwebsites.com/uploads/1/3/0/3/130379757/130379757.html#html+input+file+accept+xls+xlsx

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
stream_001_off000044b2.bin
ae5f38093d94314874748f751612ec623cf471a057f049b9650695671c71f016		 decompressed-pdf-stream PDF FlateDecoded stream at offset 0x44B2 68568 bytes
font_01_sfnt_off00010eca.bin
b3f201598b4f81c91b81e047a1c0f69968b5c0f47875ffc3ff420f71504e4645		 pdf-font-stream PDF embedded font (sfnt) at offset 0x10ECA 9388 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.