Malicious PDF — malware analysis report

Static analysis result for SHA-256 9c6e7ef5c70363ed…

MALICIOUS

PDF

37.8 KB Authoring application: Mobipocket Creator
MD5: 4bf0d612cc1fd7feee979c88f4943d25 SHA-1: a85c2ffaaee772c759cc6e6357f9252beabd95f6 SHA-256: 9c6e7ef5c70363ed9fdadbd9b45ca0c312bc8bc3e5a173089fe346c28cc58362
120 Risk Score

Malware Insights

MITRE ATT&CK
T1566.002 Spearphishing Attachment T1204.002 Malicious Link

The PDF file was identified as malicious by ClamAV with the signature Pdf.Phishing.TtraffRobotInstall-7605656-0. Static analysis revealed a large number of embedded external links, indicating a link farm likely used for phishing or distributing further malware. The document body contains text related to 'Mobipocket Creator' and quotes from Milan Kundera, which may serve as a lure to disguise the malicious intent.

Heuristics 3

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://ivyadvance.net/uploads/1/3/0/7/130739463/1591819.pdf
    • http://marshbrossaddle.com/uploads/1/3/0/7/130775962/8084765.pdf
    • http://www.zachsdrivertraining.com/uploads/1/3/0/8/130813582/aca88.pdf
    • http://dongalere.com/uploads/1/3/0/6/130621206/6407289.pdf
    • http://cadenceleadershipgroup.com/uploads/1/3/0/2/130288364/056423.pdf
    • http://afcointl.com/uploads/1/3/0/7/130776446/8860020.pdf
    • http://www.float-con.com/uploads/1/3/0/5/130540017/3564502.pdf
    • http://elektromigration.com/uploads/1/3/0/7/130775596/9426058.pdf
    • http://buchanannutrition.com/uploads/1/3/0/4/130483351/7783281.pdf
    • http://lingua360.org/uploads/1/3/0/7/130776328/37f1df16.pdf
    • http://messianicmetis.ca/uploads/1/3/0/6/130621464/e7b2746a7c4c2.pdf
    • http://sosthand.com/uploads/1/3/0/3/130323206/b2487cb127e.pdf
    • http://www.awisialkoandcompany.com/uploads/1/3/0/5/130539599/vepixojajevatila.pdf
    • http://3828riverroadbricknj.com/uploads/1/3/0/5/130543761/rereg.pdf
    • http://www.gypsyweedlife.com/uploads/1/3/0/8/130813922/6157571.pdf
    • http://realizationofdreams.com/uploads/1/3/0/6/130639590/21c9588bf02.pdf
    • http://www.invigora.de/uploads/1/3/0/9/130969645/868e96381bd61.pdf
    • http://cordiaaladvies.nl/uploads/1/3/0/7/130775249/4514064.pdf
    • http://asociacionperiodistaspr.org/uploads/1/3/0/4/130488780/130488780.html#milan+kundera+la+insoportable+levedad+del+ser+frases

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off000037e1.bin
c57077fa8e0e8f6eac7665bc2f1bdb8b92666cf26054690169074fb81942b5ca		 pdf-font-stream PDF embedded font (sfnt) at offset 0x37E1 7904 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.