Malicious PDF — malware analysis report

Static analysis result for SHA-256 9673d6795961fce2…

MALICIOUS

PDF

37.0 KB Authoring application: QPDF
MD5: 6e4afacf6b9082522c261c63b3db4d76 SHA-1: 90f5047db957e1e20b8335b5863b44f3aecd049c SHA-256: 9673d6795961fce20fb00809c15c12587f44ce8e496f413b01863dd7f9fdb749
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of external links, identified by the PDF_SEO_LINK_FARM heuristic. This suggests the file's primary purpose is to redirect users to potentially malicious websites, possibly for phishing or malware distribution. The ClamAV detection as Pdf.Phishing.TtraffRobotInstall further supports a phishing-related intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://dragonflyfloralrentals.com/uploads/1/3/0/3/130379818/7651661.pdf
    • http://949washingtonstreet.com/uploads/1/3/0/2/130273803/6908174.pdf
    • http://shambling-shimmies.com/uploads/1/3/0/7/130738740/xirozuku.pdf
    • http://michanti.com/uploads/1/3/0/4/130490053/tijemapogi-vuwujedomotisi-favuxizowija-tisametesibud.pdf
    • http://nrttourscentre.com/uploads/1/3/0/2/130272084/9543337.pdf
    • http://texasinstituteofrealestate.com/uploads/1/3/0/4/130489230/2230360.pdf
    • http://empowerdeverydaypeople.com/uploads/1/3/0/3/130323703/gakipoxaven-mizanupifese-wofedebekodazu.pdf
    • http://huskercarwash.com/uploads/1/3/0/2/130289292/1cda69af32db.pdf
    • http://churchesinmilwaukee.com/uploads/1/3/0/7/130775986/doxuzowolibewisuk.pdf
    • http://emrekulali.com/uploads/1/3/0/2/130270796/jarusofitum.pdf
    • http://parodontistebrossard.com/uploads/1/3/0/6/130639123/jofepuwetibuwotakel.pdf
    • http://jadwar.com/uploads/1/3/0/4/130489038/36cafb3d42.pdf
    • http://mylarkapparel.com/uploads/1/3/0/6/130621995/4377137.pdf
    • http://www.pioneertv.org/uploads/1/3/0/7/130776850/rusisopasexusur-vijipuniboxob-betosigevuzujuf-midipivudejesed.pdf
    • http://caketheirday.com/uploads/1/3/0/5/130542940/6a46689e.pdf
    • http://10thirtychoir.org/uploads/1/3/0/4/130488969/jakesusopu.pdf
    • http://cigadesigns.co.uk/uploads/1/3/0/5/130588728/342282a4.pdf
    • http://gottimber.com/uploads/1/3/0/6/130639116/bojikobakojo.pdf
    • http://www.vbstonework.com/uploads/1/3/0/5/130540493/pasafifepone.pdf
    • http://liduoguojiyulehuisuo.br3h.com/uploads/1/3/0/4/130435755/130435755.html#autodesk+autocad+civil+3d+2017+serial+number

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003248.bin
08192332a6d59d4d5dc0be287b53afdf59c60b9587ec25f164a0196f46de41fa		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3248 7688 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.