Malicious PDF — malware analysis report

Static analysis result for SHA-256 8e55698113c519d4…

MALICIOUS

PDF

36.1 KB Authoring application: Solid Converter PDF
MD5: fea3d78e7688cce7cc245fa9b7920875 SHA-1: 8360c4e5866fc34ede3dc900356b546d1532350c SHA-256: 8e55698113c519d4d3f9c0a09d30b4c4788e2a03882eba08e1814423d3b4454e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links point to various PDF files hosted on different domains, suggesting a coordinated effort to distribute malicious content or manipulate search engine results. The ClamAV detection further confirms the malicious nature of the file, classifying it as Pdf.Phishing.TtraffRobotInstall-7605656-0. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://aisdcoatdrive.org/uploads/1/3/0/5/130551556/050627711404.pdf
    • http://mediclear.net/uploads/1/3/0/8/130874115/987746.pdf
    • http://vjohnsonperceptionsllc.com/uploads/1/3/0/4/130435667/balomerela.pdf
    • http://delarosacreations.net/uploads/1/3/0/4/130490451/zisimuliliwuda_benudoxitef.pdf
    • http://newyorksocialpages.com/uploads/1/3/0/3/130323341/vanesuliluvurikazup.pdf
    • http://host174.aesco.com/uploads/1/3/0/5/130551188/guneselalufoganuxi.pdf
    • http://myidahoinsure.com/uploads/1/3/0/6/130620847/185181.pdf
    • http://motivationalfactor.com/uploads/1/3/0/3/130379740/kumeneju-bedub-xotoraxadiwivo.pdf
    • http://kevinadventures.com/uploads/1/3/0/7/130776233/4451162.pdf
    • http://fosteringthefearless.com/uploads/1/3/0/5/130541133/nasowoz.pdf
    • http://hostmaster.surgicaltrainingnetwork.org/uploads/1/3/0/5/130589083/8608433.pdf
    • http://marriedinmaine.net/uploads/1/3/0/5/130545684/3307127.pdf
    • http://littlehouseonthegrid.net/uploads/1/3/0/6/130620364/malakawes.pdf
    • http://jcsqualityservices.com/uploads/1/3/0/8/130873863/vamujuwapulezufobuw.pdf
    • http://hokuainvestments.com/uploads/1/3/0/6/130605306/dawope.pdf
    • http://www.mystudio500-woodfiredpottery.com/uploads/1/3/0/5/130543310/dexalil.pdf
    • http://lloydstreeter.com/uploads/1/3/0/5/130539728/c898df505457946.pdf
    • http://www.rydalmerefc.com/uploads/1/3/0/4/130436367/126851.pdf
    • http://krutimodekurty2017.com/uploads/1/3/0/2/130270777/5691695.pdf
    • http://74-123-79-182.mgwnet.com/uploads/1/3/0/2/130289779/130289779.html#travelling+salesman+problem+c+++code

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002d34.bin
ca4a2789bbb00c69d699956c0ded6b25d7533445e68f7d81e8608c5904354934		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2D34 8292 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.