Malicious PDF — malware analysis report

Static analysis result for SHA-256 928b605bd1071fe0…

MALICIOUS

PDF

37.4 KB Authoring application: ImageMagick
MD5: 3ccb4026eb1edc6e233b128b2f20d838 SHA-1: 3e86a458224ca82842482900a6d648ce3cdc31cd SHA-256: 928b605bd1071fe01fc07c72ac7c961563afb0d0ac435586251ae2db87fd4c62
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Phishing: Spearphishing Attachment T1566.002 Phishing: Spearphishing Link

The PDF file was detected by ClamAV as Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a large number of embedded external links, many of which point to PDF files hosted on various domains. This suggests a link farm or phishing campaign designed to redirect users to malicious content. The document body contains a mix of seemingly random text and the extracted URLs, further supporting the phishing or SEO manipulation motive.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://collegeauditionsupport.com/uploads/1/3/0/3/130379902/mijovudovo-wikotupifuti-nilevefi-xamaxakojiv.pdf
    • http://myulrika.com/uploads/1/3/0/6/130604515/437419.pdf
    • https://falipikarubot.weebly.com/uploads/1/3/0/5/130543784/gunuro-bumagufam.pdf
    • http://aquariusfunding.com/uploads/1/3/0/6/130620982/16593867.pdf
    • http://kosi.teldiuxmexico.com/uploads/2020/01/28/bf991eb9e014ea.pdf
    • https://levozejilo.weebly.com/uploads/1/3/0/3/130313383/nujemitigerutej.pdf
    • http://gabuxatovu.podarysam.ru/uploads/2020/01/28/jemutu_gawidisawesux_bidefareri.pdf
    • http://mev.wellsonlineserviceverifications.biz/uploads/2020/01/28/2134615.pdf
    • http://ximiwa.conditionsnap.com/uploads/2020/01/27/4bca302ff.pdf
    • http://sadielakeevents.com/uploads/1/3/0/6/130605196/pisiweme.pdf
    • http://monicajlivingston.com/uploads/1/3/0/5/130539350/sexibarag-wanojaxi.pdf
    • http://yoursurgeon.org/uploads/1/3/0/3/130313854/99e308a3663.pdf
    • http://kunufake.deevki.icu/uploads/2020/01/28/liziroluvere.pdf
    • https://fanadelonilavo.weebly.com/uploads/1/3/0/3/130313641/4374405.pdf
    • http://mrskramlsclass.com/uploads/1/3/0/4/130435649/6705825.pdf
    • http://mollylizzio.com/uploads/1/3/0/4/130475892/909be950a563385.pdf
    • http://kerosiw.focus-travel.ru/uploads/2020/01/28/vujamepunulev.pdf
    • http://pixelsxblocks.com/uploads/1/3/0/4/130477661/130477661.html#telugu+bhakthi+geethalu+naa+songs

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000014f7.bin
1d9be6c01f1caaba67f77280816aa288653dfbdf3bf099049d5fb22efc919e66		 pdf-font-stream PDF embedded font (sfnt) at offset 0x14F7 7840 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.