Malicious PDF — malware analysis report

Static analysis result for SHA-256 8c3a56c4cb02ea1c…

MALICIOUS

PDF

36.3 KB Authoring application: Solid Converter PDF
MD5: 4b01e8d9b2ada7e7519b5c0909a5cada SHA-1: 1abac7d27fcceed0c69bad4dc93e67b6be34bdb2 SHA-256: 8c3a56c4cb02ea1cee3c0cb1ab4723891b208381ebe823abea8c0587ca28dea8
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to external PDF files, a technique often used for SEO manipulation or to host phishing content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' strongly suggests a phishing intent. The document body, though partially garbled, mentions 'Solid Converter PDF' and 'Holes reading level', possibly as a lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://bebrave.studio/uploads/1/3/0/2/130270874/wolizubosot_nugekip_xexosodofune.pdf
    • http://latoniaprice.com/uploads/1/3/0/6/130620808/1390900.pdf
    • http://elder-well.net/uploads/1/3/0/6/130621439/nososibe-babinejezazonug-pefuximune.pdf
    • http://andres-historical.com/uploads/1/3/0/2/130289205/kadow.pdf
    • http://askthetutor.ca/uploads/1/3/0/6/130605165/4616162.pdf
    • https://wugezipeluz.weebly.com/uploads/1/3/0/4/130483117/rejinut-kekaralatida-mixafiv.pdf
    • http://kelseyleonofficial.com/uploads/1/3/0/6/130621555/34fa719d586b8f.pdf
    • http://ms-pollack.com/uploads/1/3/0/6/130603764/2819167.pdf
    • http://meshayla.com/uploads/1/3/0/4/130435772/130435772.html#holes+reading+level
    • http://regionc.swe.org/uploads/1/3/0/2/130289211/tevadibijo.pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000122f.bin
b195d29107e68fb68a839d49613874ff91afee3678fade95c1ab2143b13bf9f4		 pdf-font-stream PDF embedded font (sfnt) at offset 0x122F 8304 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.