Malicious PDF — malware analysis report

Static analysis result for SHA-256 910a290230771965…

MALICIOUS

PDF

43.5 KB Authoring application: QPDF
MD5: 4926e9e48f4b220016ad2adbabe59bf0 SHA-1: bdc3eea2c8fb43975b09170ca21a327746083b93 SHA-256: 910a2902307719654b748cc668756578a11ecc22c1d078b6bab82a815facea2f
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, as indicated by the PDF_SEO_LINK_FARM heuristic. These links predominantly point to PDF files hosted on various domains, suggesting a link farm designed to distribute malicious content or conduct phishing. The ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports the malicious intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://pagangarden.com/uploads/1/3/0/5/130541552/540674.pdf
    • http://murraysfools.com/uploads/1/3/0/5/130545816/4d4f3c7fd2a.pdf
    • http://disabilitymanagmentsolutions.ca/uploads/1/3/0/7/130739559/5353852.pdf
    • http://3albab.net/uploads/1/3/0/5/130550703/kutujidatoto.pdf
    • http://lasamazonasdist.com/uploads/1/3/0/8/130814247/wenusajikukodapa.pdf
    • http://mirrormirrorministries.com/uploads/1/3/0/2/130273733/2734258.pdf
    • http://alohastudionh.com/uploads/1/3/0/5/130543575/5b698.pdf
    • http://orangebaseball.org/uploads/1/3/0/5/130588928/guteza.pdf
    • http://www.steviebillenness.com/uploads/1/3/0/3/130313398/c7b0121e0a.pdf
    • http://myskiped.com/uploads/1/3/0/5/130540082/2b44bc.pdf
    • http://candacegraham.com/uploads/1/3/0/7/130738936/regoluso-kemerijo-pozogemugeva.pdf
    • http://www.headblocks.org/uploads/1/3/0/5/130539768/6378810.pdf
    • http://austinbrunkhorsthomes.com/uploads/1/3/0/4/130476513/17170c280e.pdf
    • http://birthdaygiftforwife.net/uploads/1/3/0/5/130539403/golesolunekeruj.pdf
    • http://mingaretreatcenter.org/uploads/1/3/0/5/130543772/jubotoraponup_rofigovasanita.pdf
    • http://gardeninglore.com/uploads/1/3/0/7/130740113/2145080.pdf
    • http://mrandmrslynch.net/uploads/1/3/0/7/130775565/56fc0542737.pdf
    • http://the-boujee-boutique.com/uploads/1/3/0/7/130740292/rivotasirew.pdf
    • http://rick8.com/uploads/1/3/0/2/130289426/najivoxeg-voxuzazeva-birosele.pdf
    • http://yearsofadventures.com/uploads/1/3/0/7/130775722/murowira-xudafux-nexow-kojoxeb.pdf
    • http://rachelreding.net/uploads/1/3/0/2/130273814/6156057.pdf
    • http://soilstewards.com/uploads/1/3/0/7/130775211/2c640d12812b8.pdf
    • http://nadjamoore.com/uploads/1/3/0/4/130483386/5953994.pdf
    • http://ccamsolutions.com/uploads/1/3/0/4/130477048/zonogis.pdf
    • http://aammf.bpmtc.com/uploads/1/3/0/5/130588443/130588443.html#icd+10+code+for+acute+gastroenteritis+with+mild+dehydration

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000045ef.bin
8378307947cf17cc1558a7e4a540257eb0687903d8afdf61cf802fa8866e0258		 pdf-font-stream PDF embedded font (sfnt) at offset 0x45EF 8416 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.