Malicious PDF — malware analysis report

Static analysis result for SHA-256 9dd5c72d51436cf7…

MALICIOUS

PDF

43.7 KB Authoring application: Inkscape
MD5: cb98a0c5a962aa3685896f137ab4f0c4 SHA-1: ed425469f84761a8c60762881dd9cfed2dec8a0e SHA-256: 9dd5c72d51436cf701e6ba25c17a96bfff413f77f72343837552c2b6099473b7
160 Risk Score

Malware Insights

MITRE ATT&CK
T1204 Malicious Link T1204.001 Malicious Link: User Execution T1566 Phishing T1566.002 Phishing: Spearphishing Attachment

The PDF contains a large number of external links, many of which are structured as SEO-optimized PDF links, suggesting a link farm or redirection mechanism. The heuristic 'SE_BROWSER_INSTALL_LURE' indicates the document's content prompts the user to install a browser extension or update. This combination strongly suggests a phishing or social engineering attack aimed at tricking users into installing potentially malicious software or visiting compromised sites. The ClamAV detection further supports the malicious classification.

Heuristics 4

  • Small PDF contains mass external PDF link farm critical PDF_SEO_LINK_FARM
    Small PDF contains many clickable external PDF links, mostly clustered on one host. This matches generated SEO/link-farm PDF carriers used to route users into malicious or unwanted-software delivery chains, rather than a normal document citation pattern.
  • ClamAV: Pdf.Phishing.TtraffRobotInstall-7605656-0 critical CLAMAV_DETECTION
    ClamAV detected this file as malware: Pdf.Phishing.TtraffRobotInstall-7605656-0
  • Browser extension / update installation lure high SE_BROWSER_INSTALL_LURE
    Document tells the user to install a browser extension, plugin, viewer, or browser update to view content — a common social-engineering path for credential theft and malware installation
  • Embedded URL info EMBEDDED_URL
    One or more URLs were extracted from the document. The URL itself is not a detection — see the per-URL labels for which channel (macro, JS, link annotation, document body, ...) reached each URL.
    URL http://mr-castironcreations.com/uploads/1/3/0/4/130476589/441777.pdf
    • http://concordlawncareservices.com/uploads/1/3/0/3/130379287/1211914.pdf
    • http://agencystatus.com/uploads/1/3/0/6/130620651/tikilonekiro-xevelux.pdf
    • http://theroguegolfclub.com/uploads/1/3/0/6/130620690/2ce4156c49e.pdf
    • http://spb-lavanda.ru/uploads/2020/01/29/pirabikadide.pdf
    • http://nicolesnaturals.blog/uploads/1/3/0/6/130621044/garude.pdf
    • http://renderbarn.com/uploads/1/3/0/2/130289225/dijalalibudovis_letapujigotegum_naxedejijawoza.pdf
    • http://michaelazoe.com/uploads/1/3/0/6/130621516/09c3bb8db481cb8.pdf
    • http://cestagift.com/uploads/1/3/0/5/130588220/raxeviwogor_jutulidogozuwi_zomudo_vanebidija.pdf
    • http://mishevski.de/uploads/1/3/0/2/130272606/busota_viwokaju_fujefibinare_xezetenu.pdf
    • http://escaperoomfairfax.com/uploads/1/3/0/6/130639545/kewab-wemav-puzirogevujewus-fufadufatifugi.pdf
    • http://visitwesternheritagecenter.org/uploads/1/3/0/7/130776413/leriximugam.pdf
    • http://mindforyou.org/uploads/1/3/0/7/130776358/130776358.html#adobe+acrobat+standard+dc+2015+update

Extracted artifacts 1

Files carved from inside the sample during analysis.

FilenameKindSourceSize
font_00_sfnt_off00001445.bin
0029ece7dd83569dc6908de11ce3d238947a9051f4ddecc92d942e68939089b5		 pdf-font-stream PDF embedded font (sfnt) at offset 0x1445 9296 bytes

Open this report in the interactive analyzer, or submit your own file for analysis.