Malicious PDF — malware analysis report

Static analysis result for SHA-256 8d08470573a6ca28…

MALICIOUS

PDF

30.8 KB Authoring application: pdf-parser
MD5: f582759436bd8895690df92d06e4fb85 SHA-1: 3650e0ff97a4c6ca2440d5a7e43f0650c876701b SHA-256: 8d08470573a6ca2857be579247b95893c96d51e70269f9958c5cda2fdf7ff450
128 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious File

The PDF file contains a large number of external links, identified as a PDF_SEO_LINK_FARM heuristic, pointing to other PDF files hosted on various domains. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' and the presence of embedded URLs strongly suggest a phishing or malicious content distribution scheme. The document body, though partially corrupted, contains text related to a presentation rubric, likely a lure to disguise the malicious intent.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Visual download / call-to-action button lure low SE_DOWNLOAD_BUTTON
    Document contains a call-to-action phrase ('Click here to download', 'Download Now', etc.) — low-signal unless other findings point to a malicious workflow
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://thetailory.net/uploads/1/3/0/7/130740573/tugogadejimizavinob.pdf
    • http://resurrectionofarunner.com/uploads/1/3/0/7/130739247/c993749.pdf
    • http://mymumsolvescrime.net/uploads/1/3/0/3/130312985/6da8a0bdee.pdf
    • http://www.virginianutritionists.org/uploads/1/3/0/4/130435518/kamosuwagipujob.pdf
    • http://airyfitness.com/uploads/1/3/0/6/130603728/zujevukusesab.pdf
    • http://noblocky.com/uploads/1/3/0/4/130489055/siridod.pdf
    • http://djmomradio.com/uploads/1/3/0/4/130483514/8085738.pdf
    • http://hpewindowssiding.com/uploads/1/3/0/6/130639821/jupaburepotomuj.pdf
    • http://drivenwildmn.com/uploads/1/3/0/6/130604180/2090259.pdf
    • http://antwerpandnewyork.com/uploads/1/3/0/2/130289524/200b254bf4eb7d.pdf
    • http://chubbycheetah.com/uploads/1/3/0/6/130639701/3208468.pdf
    • http://networkhearing.net/uploads/1/3/0/6/130640048/zesigifodobusopo.pdf
    • http://thriftstorehemet.com/uploads/1/3/0/2/130272600/2801616.pdf
    • http://acnightmarket.com/uploads/1/3/0/2/130271240/4d39bad.pdf
    • http://www.kathydnguyen.com/uploads/1/3/0/6/130604752/bomeg.pdf
    • http://essentialcleaning.vegas/uploads/1/3/0/7/130739197/wumofipisibafu.pdf
    • http://matthewgordonphotos.net/uploads/1/3/0/4/130483447/tewipevonamaxul.pdf
    • http://rochecenter.org/uploads/1/3/0/7/130740357/130740357.html#rubric+for+oral+presentation+4th+grade

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001d49.bin
689a328cfb2b6d12e6e6dec5b99d4f26134d2aaed37261b6cc4d2a40ea211f87		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1D49 7188 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.