Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c1ecf1d8e6455d2…

MALICIOUS

PDF

41.5 KB Authoring application: Inkscape
MD5: 8038fa1ab3a7730cd15c3ce4130c84c9 SHA-1: 4c952e275d163a0a05a1e9e3294950b618e57905 SHA-256: 9c1ecf1d8e6455d220a170fb99d6ea8f14dc9c4487674c0bf54d03445b7f0e20
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.001 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by ClamAV with the signature Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a significant number of embedded external links, characteristic of a link farm. The primary heuristic firing, PDF_SEO_LINK_FARM, confirms this, indicating the document's purpose is to direct users to numerous other PDF files hosted across various domains. No scripts were extracted from this sample.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://blackpowerchronicles.com/uploads/1/3/0/4/130489933/e56d671ec592a2.pdf
    • http://redeeminghope.net/uploads/1/3/0/5/130588232/646b5ff064e6.pdf
    • http://brooksindustries13.com/uploads/1/3/0/8/130813957/034897c.pdf
    • http://www.lhvbresources.com/uploads/1/3/0/7/130739528/kagubedabev.pdf
    • http://kaffeeblack.biz/uploads/1/3/0/2/130288661/4341226.pdf
    • http://mail.r3fine.com/uploads/1/3/0/3/130379465/dadosofow.pdf
    • http://alexandriasday.com/uploads/1/3/0/4/130476078/vagikasetiroteduv.pdf
    • http://mommyandbeeboutique.com/uploads/1/3/0/5/130550855/guribudagosanu_napixavunuvima.pdf
    • http://emirefendic.com/uploads/1/3/0/4/130435672/wulotukexijesu_jupimiv.pdf
    • http://www.sonoraprojects.com/uploads/1/3/0/6/130603860/27df7dd.pdf
    • http://www.simonbrightsalon.com/uploads/1/3/0/3/130323381/duvate-tetofororutila-rofux.pdf
    • http://alliesonthejourney.com/uploads/1/3/0/2/130273814/fivora.pdf
    • http://rockthecatspa.us/uploads/1/3/0/7/130775257/8276978.pdf
    • http://sta-66-99-58-221.ladse.org/uploads/1/3/0/6/130640105/130640105.html#lm555+national+datasheet

Extracted artifacts 3

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001da8.bin
76d0edce5bdb93a691a0309c49e7369480f5d97eef5486ab960fc16df6d92a06		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1DA8 16384 bytes
font_01_sfnt_off0000332d.bin
c9f2766864d727e1393aa645f689f1e349cca9ca80d00af93de57b1bbf7dc8a8		 pdf-font-stream PDF embedded font (sfnt) at offset 0x332D 5532 bytes
font_02_sfnt_off00004754.bin
14322085f51256465881bd7889e87cdecde454110ded3aa37689a7cb9361d2f0		 pdf-font-stream PDF embedded font (sfnt) at offset 0x4754 8964 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.