Malicious PDF — malware analysis report

Static analysis result for SHA-256 9955b3cb77421a51…

MALICIOUS

PDF

35.8 KB Authoring application: Soda PDF
MD5: 6960aec3762a85089ac587eaa79f41b3 SHA-1: f660f03a765d4843f13f8b905d4033e6c4eb4dbd SHA-256: 9955b3cb77421a51ae867e2912cbd10c1bc164501e300ac102520f1073eaa73e
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded URLs pointing to other PDF documents hosted on various domains. This behavior is indicative of a link farm or a distribution mechanism for further malicious content, as suggested by the 'PDF_SEO_LINK_FARM' heuristic. The ClamAV detection further supports its malicious nature. No scripts were extracted, and the document body text is largely obfuscated, making it difficult to determine the exact user-facing lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://connexionadr.com/uploads/1/3/0/6/130604973/8002046.pdf
    • http://mombligation.net/uploads/1/3/0/5/130539714/mizaviwa.pdf
    • http://stanleyskidsministry.org/uploads/1/3/0/6/130603891/abb02839f.pdf
    • http://exchangeclubmobile.org/uploads/1/3/0/3/130380037/df246ca9ac91.pdf
    • http://carlocornelli.com/uploads/1/3/0/4/130435937/dufaji.pdf
    • http://discourse-x.com/uploads/1/3/0/3/130323738/paged_sekefuzu_wadisokedatarob_jelidasokugow.pdf
    • http://sportsbus.com/uploads/1/3/0/5/130551524/jobufemipixa_bozij.pdf
    • http://propertymanagerfinder.com/uploads/1/3/0/6/130604501/414495.pdf
    • http://claireallegrataylor.com/uploads/1/3/0/5/130588287/3873956.pdf
    • http://mymeds.info/uploads/1/3/0/4/130489431/5f4503a9e85458.pdf
    • http://mizzenmanagement.com/uploads/1/3/0/6/130620912/4489a007.pdf
    • http://hello-baby-toys.com/uploads/1/3/0/5/130589286/130589286.html#area+of+compound+shapes+worksheet

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001276.bin
41ec1d00c13176a4bf6d702c447b7ba362f1b665f12689ac2675dd08163faf8d		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1276 7616 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.