Malicious PDF — malware analysis report

Static analysis result for SHA-256 9b2cc67c95dcb4cf…

MALICIOUS

PDF

49.1 KB Authoring application: Smallpdf Desktop
MD5: 7081267cb09c574453edd7e2b4528d7e SHA-1: ea42d9e6559549f604169cc7cee3a45805452100 SHA-256: 9b2cc67c95dcb4cf35b3381cc4cab0e4e112c5dd89528b6140f0fb01a16726d5
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file contains a large number of embedded external links, a technique often used for SEO manipulation or to distribute malicious content. The ClamAV detection 'Pdf.Phishing.TtraffRobotInstall-7605656-0' further supports a phishing or malicious distribution intent. The document body appears to be corrupted or truncated, preventing a more detailed analysis of its specific lure.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://sesacademy.org/uploads/1/3/0/6/130620478/7732391.pdf
    • http://giresungiyim.com/uploads/1/3/0/5/130539021/69889286bcb5.pdf
    • http://oroi.biz/uploads/1/3/0/7/130775472/8569333.pdf
    • http://thisismylifesong.org/uploads/1/3/0/6/130604227/dcca9f5.pdf
    • http://www.audacast.com/uploads/1/3/0/3/130323213/jatudisunok.pdf
    • http://dvmlibrary.com/uploads/1/3/0/6/130605373/lariwa.pdf
    • http://thesimplechristian.com/uploads/1/3/0/6/130639241/lugamix_bugorutowi_bidutufezenivi_limabulib.pdf
    • http://rusewood.net/uploads/1/3/0/2/130289211/ec5017938b.pdf
    • http://sydneyft.com/uploads/1/3/0/3/130379522/papaxinedapuwo.pdf
    • http://ballerweekly.com/uploads/1/3/0/6/130621495/2307321.pdf
    • http://sonopadronedellamiavita.org/uploads/1/3/0/2/130271131/9607924.pdf
    • http://nunavikyouthhouseassociation.com/uploads/1/3/0/4/130477152/5760592.pdf
    • http://myerstownboyscouts.com/uploads/1/3/0/5/130538939/1c7ce.pdf
    • http://propertypix.org/uploads/1/3/0/6/130605443/a2d2a245.pdf
    • http://zwickenterprises.com/uploads/1/3/0/5/130550895/433356.pdf
    • http://ormansite.com/uploads/1/3/0/7/130739212/nunotuxigifepet.pdf
    • http://christinahankinsart.com/uploads/1/3/0/4/130483552/9650523e69831d.pdf
    • http://www.lowetruckingworld.com/uploads/1/3/0/2/130287495/2f943e91d48cd.pdf
    • http://www.12dtech.com/uploads/1/3/0/6/130639995/ninewujeterefaxos.pdf
    • http://www.fitvibeswithangie.com/uploads/1/3/0/6/130620490/9aaad3b.pdf
    • http://marianoelide.com/uploads/1/3/0/2/130288684/02df506f16.pdf
    • http://insicknessandinhealth.info/uploads/1/3/0/6/130621261/razipow.pdf
    • http://amlanordstages.com/uploads/1/3/0/3/130379482/2324948.pdf
    • http://webmail.jhigh18.com/uploads/1/3/0/6/130639687/130639687.html#scones+recipe+with+olive+oil

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00003859.bin
b195ba776360337e0c8847a1f70ebf7e776628c0b6b62df72d82cae76b96cbf1		 pdf-font-stream PDF embedded font (sfnt) at offset 0x3859 16248 bytes
font_01_sfnt_off00004d75.bin
50224c6c483bfa86a10f62efd7baa2c756f8036c0a911ebd537387e21b2fb6f3		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4D75 2732 bytes
font_02_sfnt_off000059f1.bin
693b843a16dfc39c8759a73eb32b73e8b017ad0c2dd670768c480523ab484ea5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x59F1 9260 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.