Malicious PDF — malware analysis report

Static analysis result for SHA-256 8f91f9feb5412715…

MALICIOUS

PDF

39.7 KB Authoring application: Mobipocket Creator
MD5: 702ef71935847688b6b83c1b575e05fe SHA-1: 8a56bc62a525d681c6a69056b05f66032b44db74 SHA-256: 8f91f9feb54127155d42c609354f32cf08f29c98ed9420113d1e87fc2b1794bb
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by ClamAV with the signature Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a PDF_SEO_LINK_FARM heuristic, indicating the presence of numerous embedded external links. These links, such as http://oliviawinter.net/uploads/1/3/0/2/130289681/26ecd80786c.pdf, are likely used to redirect users to phishing sites or download further malicious content. The document body contains a large list of these URLs, reinforcing the link farm attack pattern.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://oliviawinter.net/uploads/1/3/0/2/130289681/26ecd80786c.pdf
    • http://suwozigi.ethereumcryptos.biz/uploads/2020/01/28/resonod.pdf
    • http://michaelphelannotary.com/uploads/1/3/0/5/130588923/7e2e42df.pdf
    • http://susanfisherart.com/uploads/1/3/0/7/130776741/semenurimexoriv.pdf
    • http://swingstatereal.estate/uploads/1/3/0/8/130814129/c85ea80.pdf
    • http://aly-raisman.info/uploads/1/3/0/6/130604581/ae486d2.pdf
    • http://metrowalkatlanta.org/uploads/1/3/0/4/130488320/1916652.pdf
    • http://annieshandmadesweets.com/uploads/1/3/0/6/130620957/zedajupetedatigiv.pdf
    • http://observationsandconclusions.com/uploads/1/3/0/2/130272649/nutujifupesi_vavubefum_fedejenap_pubuvufexepi.pdf
    • http://stockphotoheaven.com/uploads/1/3/0/5/130588556/4065720.pdf
    • http://gregsgear.com/uploads/1/3/0/6/130639504/1106082.pdf
    • http://edgelandscapeandmaintenance.com/uploads/1/3/0/7/130740465/130740465.html#cv+for+university+examples

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off0000149c.bin
569a33bb3de46567e2dc2f2cb0d9eb6a5e2406f8f85abee3cd95bdd1f5fc3b93		 pdf-font-stream PDF embedded font (sfnt) at offset 0x149C 8800 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.