Malicious PDF — malware analysis report

Static analysis result for SHA-256 83ab4744178d3a78…

MALICIOUS

PDF

45.1 KB Authoring application: Solid Converter PDF
MD5: 5f344ef00cf31b7d0ba4a9aed5f6d412 SHA-1: 02f577fe5a49110accce6b4a441ba695c35a6a78 SHA-256: 83ab4744178d3a785a07dbdc90947d630fa1989b4c3d0dff8887adb94abb2d9a
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded links to external PDF files hosted on various domains. This behavior is indicative of a link farm designed to direct users to potentially malicious content. The ClamAV detection as 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or traffic redirection motive. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://voreckcontroller.com/uploads/1/3/0/7/130740211/ddd49abc5ac.pdf
    • http://chantillyescaperoom.com/uploads/1/3/0/5/130541031/belogikafovel.pdf
    • http://prairienanotech.net/uploads/1/3/0/7/130776582/db015b5d30c43.pdf
    • http://band-ems.org/uploads/1/3/0/3/130323187/wamidiko.pdf
    • http://formal-analysis-registration.com/uploads/1/3/0/5/130546593/xololi_tebali_venedewox.pdf
    • http://huangxinyu.net/uploads/1/3/0/5/130539936/6051db05859139.pdf
    • http://mail.tatyanashealthblog.com/uploads/1/3/0/6/130620410/gefabitugofogudexo.pdf
    • http://nanlaird.com/uploads/1/3/0/5/130589337/b8a0ec8a88.pdf
    • http://www.mylittlecutfootcabin.com/uploads/1/3/0/7/130775154/849845.pdf
    • http://moldasti.store/uploads/1/3/0/5/130588625/4fbb85.pdf
    • http://michelleaalbregtsdigportfolio.com/uploads/1/3/0/6/130621918/6505059.pdf
    • http://fireflyevent.com/uploads/1/3/0/6/130621382/nupawoge-wirifalur.pdf
    • http://www.beautesache.ru/uploads/1/3/0/4/130489241/95013.pdf
    • http://fcjt-diel.nl/uploads/1/3/0/5/130589166/fuxegoxudazoj-tuxibuvodade-vufibapesej.pdf
    • http://www.b2excavatingllc.com/uploads/1/3/0/6/130639379/joguvezewu.pdf
    • http://www.bankruptcyisnotyourfault.com/uploads/1/3/0/3/130313427/pefijatezu.pdf
    • http://caseypatrickmurphy.com/uploads/1/3/0/4/130488320/nunikubefulexi.pdf
    • http://noxonroadpta.com/uploads/1/3/0/8/130874088/pulivixufo.pdf
    • http://yourblueprinttravel.voyagerwebsites.com/uploads/1/3/0/5/130538838/130538838.html#pros+and+cons+of+laissez-faire+leadership+style
    • http://formal-analysis-registration.com/uploads/1/3/0

Extracted artifacts 2

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003ab1.bin
779aa567746046747dac965df7fdfb06ff632674a0a99ce247a327bf89f0fa63		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3AB1 16036 bytes
font_01_sfnt_off000051c0.bin
021ca932613278872d82e8ee62669d6e4b46acff6490cac14fcf857cfa9021ce		 pdf-font-stream PDF embedded font (sfnt) at offset 0x51C0 8220 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.