Malicious PDF — malware analysis report

Static analysis result for SHA-256 93d1aea03d596ec3…

MALICIOUS

PDF

36.4 KB Authoring application: ImageMagick
MD5: 9417fdb5b9d64bdf95efd2dc6c181563 SHA-1: fe88ebbcc035f496d7bf7e06fe613bf72f840198 SHA-256: 93d1aea03d596ec35b12450ab5ef0a1819bafad7e6f90cb4afe56d502cf6cde0
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF document contains a large number of embedded external links, identified by the PDF_SEO_LINK_FARM heuristic. ClamAV also detected this file as Pdf.Phishing.TtraffRobotInstall-7605656-0. The embedded URLs are likely used to redirect users to malicious content or phishing sites. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://clonmannoncarecentre.ie/uploads/1/3/0/6/130605279/c54b7590.pdf
    • http://bossypaw.com/uploads/1/3/0/2/130291783/9490e.pdf
    • http://bpacontractorsme.com/uploads/1/3/0/5/130538986/34c4086dde2.pdf
    • http://inscienceitrust.net/uploads/1/3/0/5/130551144/6120743.pdf
    • http://westsaclibfriends.org/uploads/1/3/0/8/130815351/vurovox.pdf
    • http://www.entropy-machine.com/uploads/1/3/0/8/130813448/dalesebiminonukiwum.pdf
    • http://taiwaneztour.com/uploads/1/3/0/4/130436415/jovuvowibixekebumeva.pdf
    • http://moongsushi.online/uploads/1/3/0/3/130313193/fubekid.pdf
    • http://finehealthindia.com/uploads/1/3/0/7/130740553/dopuka.pdf
    • http://weed-feed.me/uploads/1/3/0/5/130545278/1365895.pdf
    • http://trtidalwave.com/uploads/1/3/0/6/130605373/e9aa03f7.pdf
    • http://jimandcarolgarlow.com/uploads/1/3/0/5/130588511/pevum_vageg_xijome_juwanopuxa.pdf
    • http://100daysofimp.com/uploads/1/3/0/6/130604263/335801.pdf
    • http://myrocketflow.com/uploads/1/3/0/7/130776295/donavilujuxozaxi.pdf
    • http://www.durhamrealestatepics.com/uploads/1/3/0/2/130291779/kogizuv.pdf
    • http://amberartglass.com/uploads/1/3/0/6/130639895/9022672.pdf
    • http://vantasseljustin.com/uploads/1/3/0/5/130588225/ade97909.pdf
    • http://agapiredesign-de.devsite-1.com/uploads/1/3/0/8/130813305/130813305.html#the+absolutely+true+diary+of+a+part-time+indian+questions+pdf

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003129.bin
486faa6a67b0b6c17c68ed6b376b4f0a630ca2291250c2b3fbcd0f2a7faba52a		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3129 8148 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.