Malicious PDF — malware analysis report

Static analysis result for SHA-256 94ee6bab0765b5f0…

MALICIOUS

PDF

36.0 KB Authoring application: GIMP
MD5: 7567d980544e34e1359f280e91c9f42a SHA-1: f3182628e297da2e1bfbb45d45f6119ae184d0bd SHA-256: 94ee6bab0765b5f0ee39b70bdeacb15d39cd2855ddd8a3990f62d18148202d44
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF contains a large number of embedded links to other PDFs hosted on various domains, a technique commonly used for SEO poisoning or distributing malicious content. The document body text, though heavily obfuscated, contains a lure suggesting browser incompatibility and offering a download link, which aligns with the heuristic firing for a PDF link farm and the ClamAV detection of 'Pdf.Phishing.TtraffRobotInstall'. This suggests the file is part of a campaign to redirect users to malicious sites or download further malware.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://www.wavewalkersapparel.com/uploads/1/3/0/7/130738933/vosixoboxa_kejojokabiva_zunomavolel_genoj.pdf
    • http://metairievolvo.com/uploads/1/3/0/4/130483426/takekikujikegi.pdf
    • http://sunsteellogistics.com/uploads/1/3/0/4/130476700/2421166.pdf
    • http://dementiadecoder.com/uploads/1/3/0/5/130590395/8920473.pdf
    • http://trustedfinancialpro.com/uploads/1/3/0/7/130776887/222225.pdf
    • http://quicktan423.com/uploads/1/3/0/2/130287943/3a552963.pdf
    • http://lapbandlosangeles.net/uploads/1/3/0/6/130621120/dizomudutuge.pdf
    • http://myrole.legal/uploads/1/3/0/7/130740010/8433319.pdf
    • http://motomomfuel.com/uploads/1/3/0/2/130289392/c1f9116e7d5.pdf
    • http://dilla.org/uploads/1/3/0/4/130477228/cd2c81b359960d.pdf
    • http://vidyavara.com/uploads/1/3/0/3/130312950/xolivor-moxulu-giwifopa.pdf
    • http://carlyzimmerman.com/uploads/1/3/0/5/130588289/967b7e9.pdf
    • http://chrisbarnwell.com/uploads/1/3/0/6/130620668/gurirasizurob.pdf
    • http://andyknguyen.com/uploads/1/3/0/7/130739579/nejozebizuzonibikir.pdf
    • http://adentabenelux.com/uploads/1/3/0/6/130604419/647637.pdf
    • http://collabsys.com/uploads/1/3/0/5/130588989/vumawifev.pdf
    • http://dimeto.com/uploads/1/3/0/6/130605018/mobivavilikexir_muwudadala_tevofodonar.pdf
    • http://cabitdesign.com/uploads/1/3/0/5/130590532/jakomefigajatojexaki.pdf
    • http://leadinlife.press/uploads/1/3/0/6/130621897/4014371.pdf
    • http://3lmboutique.com/uploads/1/3/0/6/130603753/nofezadejatem.pdf
    • http://shop.decoratingwithgrace.com/uploads/1/3/0/4/130476270/130476270.html#abaqus+6.14+scripting+reference+guide
    • http://cabitdesign.com/uploads/1/3/0

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00002e3e.bin
21557b06f9009553d127069ec646d3f52778c75f813921052a886f4234bcc766		 pdf-font-stream PDF embedded font (sfnt) at offset 0x2E3E 7512 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.