Malicious PDF — malware analysis report

Static analysis result for SHA-256 92654f16e01ebdfe…

MALICIOUS

PDF

35.7 KB Authoring application: PDF Studio
MD5: 69706f840f62f65f086206394bbf3067 SHA-1: 606d8cf94c87c08375d6ea76c4549bfc4b4fe66d SHA-256: 92654f16e01ebdfe415340f058630f3627b405c2a7630dc02f4f19e846426caf
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was detected as malicious by ClamAV and exhibits a critical heuristic firing for a PDF link farm. It contains numerous embedded URLs pointing to external PDF files, suggesting a traffic redirection or phishing scheme. The document body contains garbled text and references to 'PDF Studio', indicating it is likely a lure document. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://doctorberrycounseling.com/uploads/1/3/0/2/130272481/5ed441e1d5ab776.pdf
    • http://nicolecthomaswrites.com/uploads/1/3/0/5/130588880/bowosef-nasiwomojexekog-bixapubeduga-rotabebu.pdf
    • http://www.powderedpixiebakery.us/uploads/1/3/0/5/130551949/9024455.pdf
    • http://aammf.bpmtc.com/uploads/1/3/0/6/130604250/dukonajiregow.pdf
    • http://importeddesignz.com/uploads/1/3/0/6/130605229/rojofokot_felebamajiv_kefaj.pdf
    • http://efecto-digital.com/uploads/1/3/0/5/130588497/jewazufu_jufamupaxekepi.pdf
    • http://allfoodsafety.net/uploads/1/3/0/2/130271207/putivoxan.pdf
    • http://nwm5.club/uploads/1/3/0/2/130270923/1745850.pdf
    • http://rescuekitty.net/uploads/1/3/0/7/130740200/tuxekinuwu-jesuzafulalivex-suzaxinudes-bewonafizudi.pdf
    • http://ninaalessandri.com/uploads/1/3/0/6/130604477/xirejabesaxibu_wusowudadowiw.pdf
    • http://wip4100express.com/uploads/1/3/0/6/130604692/2112eb6f.pdf
    • http://nthatuwaconstruction.org/uploads/1/3/0/5/130551153/majijezereko.pdf
    • http://x0172818xstreamtravel.xsideas.com/uploads/1/3/0/6/130620930/130620930.html#trijicon+acog+4x32+red+chevron+weapon+sight+ta31f

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003092.bin
da91fbc40ca5d28ea11a343afe4b534f050d162602824a7059a026c32b1ef249		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3092 8788 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.